Language selection

Government of Canada / Gouvernement du Canada

Search


Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: RCMP Responses

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: RCMP Responses


Date of Publishing:

List of Acronyms

Abbreviation Expansion
2017 MD 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities
ACA (ACMFEA, or “the Act”) Avoiding Complicity in Mistreatment by Foreign Entities Act
ADM Assistant Deputy Minister
AMCC Avoiding Mistreatment Compliance Committee
CBSA Canada Border Services Agency
CRA Canada Revenue Agency
CRCC Civilian Review and Complaints Commission for the RCMP
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DFO Department of Fisheries and Oceans
DND/CAF Department of National Defence / Canadian Armed Forces
EPPP Enhanced Passenger Protect Program
FINTRAC Financial Transactions and Reports Analysis Centre of Canada
FIRAC Foreign Information Risk Advisory Committee
FPNS Federal Policing National Security
GAC Global Affairs Canada
GATE Governance, Accreditation, Technical Security and Espionage
HOM Head of Mission (or Chargé)
HRR Human Right Report
ICCPR International Covenant on Civil and Political Rights
ICE Integrated Collaborative Environment
INPL Intelligence Policy and Programs Division
IRCC Immigration, Refugees and Citizenship Canada
ISCG Information Sharing Coordination Group
LEAG Law Enforcement Assessment Group
LO Liaison Officer
MDCC Ministerial Direction Compliance Committee
NSICOP National Security and Intelligence Committee of Parliamentarians
NSIRA National Security Intelligence Review Agency
OiC Orders in Council
PPP Passenger Protect Program
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
RFI Requests for Information
TC Transport Canada
Abréviation Développement
AL Agent de liaison
AMC Affaires mondiales Canada
ARC Agence du revenu du Canada
ASFC Agence des services frontaliers du Canada
CANAFE Centre d’analyse des opérations et déclarations financières du Canada
CCDM Comité de conformité à la directive ministérielle
CCEMT Comité de conformité pour éviter les mauvais traitement
CCETP Commission civile d’examen et de traitement des plaintes relatives à la GRC
CCRIE Comité consultatif sur les risques – Information de l’étranger
CDM Chef de mission (ou chargé de mission)
CPSNR Comité des parlementaires sur la sécurité nationale et le renseignement
CST Centre de la sécurité des télécommunications
DC Décret en conseil
DI Demande d’information
ECI Environnement collaboratif intégré
GASE Gouvernance, accréditation, sécurité technique et espionnage
GCER Groupe de coordination d’échange de renseignements
GEAL Groupe d’évaluation de l’application de la loi
GRC Gendarmerie royale du Canada
IM-2017 Instructions du ministre de 2017 visant à éviter la complicité dans les cas de mauvais traitements par des entités étrangères
INPL Direction des politiques et des programmes liés au renseignement
IRCC Immigration, Réfugiés et Citoyenneté Canada
Loi visant à éviter la complicité, la Loi Loi visant à éviter la complicité dans les cas de mauvais traitements infligés par des entités étrangères
MDN/FAC Ministère de la Défense nationale/Forces armées canadiennes
MPO Ministère des Pêches et des Océans
OSSNR Office de surveillance des activités en matière de sécurité nationale et de renseignement
PIDCP Pacte international relatif aux droits civils et politiques
PPP Programme de protection des passagers
PPP-A Programme de protection des passagers amélioré
RDP Rapport sur les droits de la personne
SCRS Service canadien du renseignement de sécurité
SMA Sous-ministre adjoint
SNPF Sécurité nationale et Police fédérale
SP Sécurité publique Canada
TC Transports Canada

Executive Summary

This review focuses on departmental implementation of directions received through the Orders in Council (OiC) issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”). This is NSIRA’s third annual assessment of the statutorily mandated implementation of the directions issued under the ACA.

This year’s review covers the 2021 calendar year and has been split into three sections. First, the review addresses the statutory obligations of all departments. Sections two and three of the review focus on in-depth analysis of how the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC) have implemented the directions under the ACA. NSIRA has used case studies, where possible, to examine these departments’ implementation of the ACA framework.

NSIRA has observed that this is the third consecutive year where there have been no cases referred to the deputy head level in any department. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Future reviews will be attuned to the issue of case escalation and departmental processes for decision-making.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

In last year’s review NSIRA identified Canada Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies. While CBSA and PS continue to make advancements these departments still have not fully implemented an ACA framework and supporting policies and procedures.

RCMP has a robust framework in place for the triage and processing of cases pertaining to the ACA. The in-depth analysis portion of this review found that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances. NSIRA also found that the RCMP has not developed mechanisms to update country and entity profiles in a timely manner, and the information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In the analysis of one of the RCMP’s Foreign Information Risk Advisory Committee (FIRAC) case files, NSIRA found that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments. The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested.

NSIRA found that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA. This is a marked change from the findings of the 2019 review that found decision-making was done at the Ministerial Direction Compliance Committee (MDCC) at Headquarters.

GAC has also not conducted an internal mapping exercise to determine which business lines are most likely to be implicated by the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

NSIRA also notes that GAC has no formalized tracking, or documentation mechanism for the follow-up of caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

During the review, GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC has provided NSIRA with all documents requested within a reasonable time frame.

This review assessed departments’ implementation of the directives received under the ACA and their operationalization of frameworks to address ACA requirements. As such, this review constitutes the first in-depth examination of the ACA within individual departments.

Authorities

This review is being conducted under the authority of paragraph 8(2.2) of the National Security Intelligence Review Agency Act (NSIRA Act), which requires National Security Intelligence Review Agency (NSIRA) to review, each calendar year, the implementation of all directions issued under the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”).

Introduction

This review will focus on departmental implementation of directions received through the Orders in Council issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act. The overarching objective of this review is to assess whether departments are meeting their obligations under the ACA and associated directions. NSIRA is mandated to conduct this review on an annual basis.

Background

Many departments and agencies in the Government of Canada routinely share information with foreign entities. Given that information sharing with entities in certain countries can result in a risk of mistreatment of individuals, it is incumbent upon the Government of Canada to evaluate and mitigate the risks that such sharing creates. This is particularly the case for information sharing related to national security and intelligence, where information often relates to alleged participation in terrorism or other criminal activity.

The 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities (2017 MD), defined the substantial risk of mistreatment as:

[A] personal, present and foreseeable risk of mistreatment. In order to be ‘substantial’, the risk must be real and must be based on something more than mere theory or speculation. In most cases, the test for substantial risk of mistreatment will be satisfied when it is more likely than not that there will be mistreatment; however, in some cases particularly where there is a risk of severe harm, the ‘substantial risk’ standard may be satisfied at a lower level of probability.

This review will be NSIRA’s third annual assessment of the implementation of the directions issued under the ACA. This review will build on the previous reviews conducted in respect of avoiding complicity in mistreatment. The first review was in respect to the 2017 MD. The second review assessed the directions issued under the ACA, but was limited to the four months from when the directions were issued to the end of the 2019 calendar year. The third review was NSIRA’s first full year assessment of the implementation of the directions issued under the ACA for the 2020 calendar year.

NSIRA has focused on conducting in-depth reviews of how departments implement the directions under the ACA. This approach builds on the foundational knowledge obtained over the last three years and reviews how departments operationalize the directions under the ACA by using case studies to assess departments ACA frameworks in practice.

The review, covering the 2021 calendar year has been split into three sections. The first section addresses NSIRA’s statutory obligations covering a full year review of all departments. This year NSIRA conducted an in-depth review of two departments: the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC), sections two and three respectively.

Methodology

Subsection 7(1) of the ACA imposes a statutory obligation on the deputy head to whom directions were issued to submit a report to the Minister regarding the implementation of those directions during the previous calendar year and publish a public copy of the report. The Minister must then provide the classified copy to NSIRA.

The obligations for departments noted above are mirrored in the NSIRA Act. Under subsection 8(2.2) of the NSIRA Act, NSIRA must, each calendar year, review the implementation of all directions issued under the ACA. Additionally, NSIRA has the statutory right to review the implementation beyond the specific requirements of the ACA, namely through its mandate to review any activity carried out by a department that relates to national security or intelligence.

The issued Orders in Council (OiC) include a reporting requirement, whereby decisions necessitating referral to the deputy head for determination must be reported to the Minister and subsequently the review bodies. This requirement creates additional accountability for decisions undertaken by departments and allows NSIRA to be informed of any potential issues outside of the annual reporting cycle.

This review encompasses the implementation of the directions for the 12 departments that were in receipt of the OiC pursuant to the ACA. The review period is January 1, 2021, to December 31, 2021. Additionally, NSIRA has selected two departments for more in-depth case study review: GAC and the RCMP. NSIRA will ensure that additional departments are selected for case study analysis in future years.

In completing this review, NSIRA considered legal authorities and governance frameworks. NSIRA also relied on documentation and information obtained through briefings with the departments.

Verification of Information and Responsiveness

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments.

The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. NSIRA found that overall, its expectation for responsiveness by the RCMP during this review were met.

GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested. NSIRA found that overall, its expectation for responsiveness by GAC during this review were met.

All Departments

Framework Updates and Reporting

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework, and supporting policies and procedures are still under development.

Based on submissions to NSIRA, ten departments have established frameworks and policies addressing whether the disclosure of information to a foreign entity would result in a substantial risk of mistreatment of an individual. The submissions provided to NSIRA by Canada Revenue Agency (CRA), Department of National Defence / Canadian Armed Forces (DND/CAF), and Transport Canada (TC) indicate that they are actively working on refining existing policies and frameworks. NSIRA, in last year’s report identified Canadian Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies.

Frameworks

CBSA advised that it has provisionally approved a framework for deciding whether a request for information from a foreign entity would result in a substantial risk of mistreatment of an individual. CBSA advised NSIRA that it issued direction to conduct an internal review with the goal of confirming the feasibility of operational implementation across multiple program areas.

PS has advised that a full suite of risk assessments are under development and that it intends to conduct information sessions to ensure other program areas not directly affected by the ACA are aware of information sharing obligations. PS also advised that the program area implicated by the Ministerial Directions (the Directions) has operationalized the policy and has ensured that their procedures and processes align with the requirements outlined in the departmental policy, Act and the Directions. These policies came into effect in January 2022, with “a few aspects” having not yet been finalized. The suite of risk assessments is still in development.

PS also intends to hold information sessions with various sections of the department that may not currently need to apply the Directions, but should nonetheless be aware of their existence should they develop new programs with an information sharing dimension.

In 2020, GAC initiated a full review of the Avoiding Mistreatment Compliance Committee (AMCC) as directed by its terms of reference. GAC has advised that notional recommendations have been developed to address the identified shortcomings. Recommendations include timeliness of Committee decisions, addressing duty of care issues, and reporting case outcomes regarding Committee decisions.

NSIRA has been advised that the AMCC’s secretariat review will be completed in 2022 and the terms of reference will be updated shortly after. In response to NSIRA’s inquires about risk analysis, GAC has advised that during the review period they created a new risk assessment form and are developing a broader orientation guide with the goal of supporting employees through the risk assessment and decision-making process. These issues are further explored in section two of this report.

RCMP has noted internal shortcomings in regards to country assessments and the inability to regularly update the reports. A framework has been provided to NSIRA on how the RCMP intends to remedy these shortcomings in the future to better serve the Foreign Information Risk Advisory Committee (FIRAC) process.

Reporting

Subsection 7(1) of the Act requires deputy heads to submit a report to the appropriate Minister on the implementation of directions received under the Orders in Council during the previous year. The ACA stipulates that report submissions are required before March 01 of each year.

All twelve departments have fulfilled their obligations to report to their respective ministers The Communications Security Establishment (CSE), and TC did, however, submit their reports shortly after the March 01 deadline.

Subsection 7(2) of the Act also requires deputy heads make an unclassified version of the report available to the public as soon as feasible after submission to the Minister. Reports were made available in all of the twelve departments.

Section 8 of the Act requires the Minister to provide a copy of the report to the National Security and Intelligence Committee of Parliamentarians (NSICoP), NSIRA and, if applicable, the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC).

The table below captures a summary of both the departmental responses to the implementation questions and NSIRA’s assessment regarding these responses. The assessment was based on the associated details provided by departments in the context of the specific information requested. If a specific requirement was not met, it has been flagged. The relatively few instances of these were connected with departments not meeting certain reporting obligations under the Act.

Summary Table 1.1 – Requirements under the Act
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
Cases referred to the deputy head? No No No No No No No No No No No No
Was a report submitted to the Minister? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Was the report made available to the public? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Did the Minister provide a copy to NSICoP, NSIRA, CRCC? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes

Case Triage and Escalation

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

All twelve departments indicated that they did not have any cases referred to the Deputy Head level for determination. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Therefore, all additional reporting requirements associated with this level of decision were not applicable.

Summary Table 1.2 – Cases Escalated, by Level of Approval
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
First Level. (Supervisor/Deputy Chief) 0 634 236 (23) 780) 0 Not Known/Not Tracked 48 6 2 401 55 0
Second Level (Manager/Chief) 0 325 176 (24) 243 0 Not Known/Not Tracked 48 6 2 401 55 0
Third Level(Director/DDG) 8(25) 69
Fourth Level (DG/Committee/ Working Group) 0 63 1 (26) 81 0 7 48 0 0 0 55 0
Fifth Level (ADM/A.Commis sioner/L1) 0 0 0 (27) 0 0 2 0 0 0 0 55 0
Sixth Level (Deputy Head) 0 0 0 0 0 0 0 0 0 0 0 0

NSIRA notes that this is the third consecutive year where there have been no cases referred to the deputy head level in any department.

Future reviews may be particularly attuned to the issue of case escalation and departmental processes for decision-making, as one of the stated objectives of NSIRA’s review of ACA obligations is to ensure that the assessment of risk is escalated to appropriate level of authority.

Implementation of Previous Recommendations

As part of this review, NSIRA requested information regarding the implementation of previous recommendations. The following analysis is based on responses received from departments.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

DND/CAF has advised NSIRA that as a result of its recommendation, the department has included the definition of “substantial risk” within the Chief of Defence Intelligence Functional Directive on DND/CAF Information Sharing Activities with Foreign Entities. However, it should be noted that DND/CAF has also adopted additional definitions including its definition of “foreseeable.” NSIRA has previously expressed its concerns in its 2019 detailed Annex of DND/CAF application of the MD regarding the DND/CAF interpretation of foreseeability. DND/CAF has also advised NSIRA that it leveraged the human rights assessment methodology from other organizations to develop the methodology for DND/CAF’s profiles. DND/CAF has also advised that it is actively participating with ACA-related interdepartmental working groups to share its country’s human rights methodology, procedures, and assessments, and raise concerns.

Of the twelve departments, CRA, CBSA, CSIS, DND/CAF, PS and TC have continued to adjust frameworks and policies as a result of the findings and recommendations from previous reviews of the ACA. While recommendations may not have been specific to individual departments, many have advised that they have taken into them into consideration and applied improvements more generally.

CRA for example in response to Recommendation #1 from NSIRA’s 2019 review (regarding the importance of conducting periodic internal reviews), has reviewed its exchanges of information procedures. As a result, CRA has implemented procedural changes where risk assessments deemed to be of low-risk are now approved at the manager level, whereas previously the minimum approval level was Director.

CBSA has provisionally approved its ACA policy and is currently conducting an additional review to ensure that the policy is operable across multiple program areas. CBSA has advised that the policy includes guidance on the disclosure of information, the request for information, and the use of information where there may be a substantial risk of mistreatment of an individual. As part of the policy, the CBSA has incorporated procedures and processes to assess risk and coordinate with its Senior Management Risk Assessment Committee.

PS has also finalized its draft policy in response to NSIRA’s 2020 ACA review finding that it did not finalize its policy frameworks in support of the Direction received under the ACA. PS has noted that a policy was approved and came into effect on January 1, 2022. NSIRA has been advised additional aspects of the policy are still being implemented, including the development of risk assessment tools.

Finally, TC has advised NSIRA that it has taken stock of feedback on the implementation of the ACA since initial promulgation of the Corporate Policy in August 2020. TC notes that its corporate policy is under revision and seeks to clarify and strengthen key elements. TC has advised that adjustments underway include refining language to further clarify roles, responsibilities program-level requirements, and timelines associated with implementation. To this end, TC is providing more guidance on reporting format and content requirements for program-level support to the annual reporting exercise.

At the program level, TC is reviewing the policy impact of changes (over the past year) to the functional structure and roles associated with the Passenger Protect Program (PPP). To date, the PPP is the only program activity that TC has identified where risks associated with the ACA may be present. The PPP is currently transitioning to an enhanced framework, which is expected to be fully implemented prior to March 2023.

NSIRA maintains its previous recommendation that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the ACA.

Royal Canadian Mounted Police

The ACA review for 2021 is NSIRA’s second full year assessment of the implementation of the Act. As discussed in the background to this review, NSIRA has complemented the knowledge gained through its annual review of the ACA with an in-depth analysis of the implementation of the Directions. The in-depth analysis highlights to departments some best practices within the Government of Canada as well as some potential issues in the adopted frameworks. This year, the RCMP and GAC were selected. As one of the “original” departments subject to the 2011 Ministerial Direction, the RCMP has had over a decade to develop, implement, and adjust its framework. GAC was selected because it was issued a Ministerial Directive in 2017 and due to its role as a primary developer of human rights reports.

Implementation of the ACA

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

In 2011, the RCMP was issued the Ministerial Direction on Information Sharing with Foreign Entities. However the issued MD only applied to information sharing in national security matters. In response to the 2011 MD, the RCMP created the Foreign Information Risk Analysis Committee (FIRAC), the Committee was renamed the Foreign Information Risk Advisory Committee following the issuance of the 2017 MD.

The 2017 MD’s scope was broadened to include all units and personnel of the RCMP, and FIRAC was expanded accordingly. The enactment of the ACA imposed the requirement of the Orders in Council directions to the Commissioner. The operational requirements between 2017 and 2019 remained the same. The RCMP’s Implementation of the ACA is composed of three key mechanisms, FIRAC, Law Enforcement Assessment Group (LEAG), and Annual Reporting.

FIRAC is an advisory body to senior management, tasked with providing RCMP personnel with a mechanism to review information exchanges where there may be a substantial risk of mistreatment. FIRAC is a central part of the determination making mechanism for cases with ACA considerations. The committee examines the operational context of each request, the application of risk-mitigation strategies, and the strength of assurances and makes recommendations to the responsible Assistant Commissioner.

It is important to note that the Terms of Reference for FIRAC were updated in December 2021, this is after the conclusion of the last FIRAC meeting on the case study discussed below. The previous Terms of Reference which were drafted following the issuance of the 2017 MD stated that “in case of information sharing where there is a clear operational need to proceed, but a substantial risk of mistreatment, the decision will be referred to the Commissioner for final approval, as per the MD and Operational policy”. The revised Terms of Reference identifies that the Assistant Commissioner, or Executive Director is responsible for deciding whether the substantial risk of mistreatment can be mitigated. The Terms of Reference now clearly stipulates that the Assistant Commissioner, or the Executive Director as the sole decision maker, and that FIRAC fulfills an advisory function. NSIRA cautions that this apparent or perceived delegation of the final decision to the Assistant Commissioner risks non-compliance with the purpose and object of the Act and the OiC.

The Committee is comprised of two rotating chairs and a number of members from various divisions within the RCMP. As a result of an internal review, the RCMP have adjusted membership of FIRAC to ensure that co-chairs were not making determinations on cases from their respective units, with the intention of removing situations where a real or apparent conflict of interest could arise.

FIRAC meets bi-monthly or on an as-needed basis when urgent, time sensitive cases arise. All recommendations made by the committee are non-binding. NSIRA has also observed that the addition of Committee members is planned for April 2022.

Over the last year, the RCMP have made efforts to improve their framework and have created tools to aid personnel in engaging with FIRAC. They have established a FIRAC Coordination Unit, which is responsible for conducting consultations with personnel in order to help triage potential cases and determine the appropriate level of FIRAC engagement. The RCMP have also developed a suite of tools outlining definitions and thresholds, mitigation strategies and FIRAC requirements.

The FIRAC Coordination Unit works with RCMP staff, and members to assist with the risk assessment process and determine if a FIRAC evaluation is required. The Coordination Unit’s roles and responsibilities have been adjusted with the stated goal of providing guidance and support to members to strengthen case submissions. The intent of the Unit is to improve upon record keeping, identify internal strategic level issues, engage with external federal partners on cross-cutting issues to enhance processes and practices, and to share outcomes of case-specific FIRAC meetings with LEAG to inform updates on foreign entity assessments.

The RCMP is also in the final stages of updating its operational manual with the goal of supporting the Direction’s consistent application across the RCMP. This update is intended to clarify roles and responsibilities, as well as thresholds and triggers that require an information exchange to be reviewed by FIRAC.

As will be addressed later in this report, the 2019 OiC includes a requirement for the case to be referred to the RCMP Commissioner for determination, where officials are unable to determine whether the risk of sharing information can be mitigated. Additionally, pursuant to section 3(1)c of the OiC, the RCMP Commissioner must report and disclose any information considered in making the determination or decision to NSIRA, the Civilian Review and Complaints Commission for the RCMP (CRCC), and the National Security and Intelligence Committee of Parliamentarians (NSICoP) in a timely manner, if certain information that was likely obtained through the mistreatment of an individual by a foreign entity was used, in order to prevent loss of life, or significant personal injury.

The LEAG is responsible for developing country assessment profiles and maintaining the Integrated Collaborative Environment portal, where the information is stored and accessed by officers as needed. NSIRA was informed that during the last few years, the LEAG team has been severely underfunded and under-resourced, resulting in country profiles that are out of date with a third of countries having no assessment report whatsoever.

An annual report detailing the implementation of the Act and any cases brought to the Commissioner for determination must be sent to the Minister of Public Safety, NSIRA, NSICoP and the CRCC. The RCMP must also disclose any information considered in the making of a determination or decision. For full description of the RCMP’s process please see Annex A: Departmental Frameworks.

The RCMP continues to improve upon FIRAC process. Recently, the RCMP has made strides to enhance products used to assess whether proposed information exchanges carry a substantial risk of mistreatment that require FIRAC assessments. These improvements include visual tools outlining the decision-making process, key definitions, mitigation strategies, and triggers for a FIRAC evaluation.

RCMP continues to make considerable progress on updating resources on the designated SharePoint site, the ACA training module, and policy in the RCMP operational manual. While these initiatives are still in progress, NSIRA commends the RCMP’s initiative in conducting an internal review of FIRAC, and making efforts to address identified shortcomings.

Information Sharing Framework and Risk Analysis

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment, is a best practice.

The RCMP’s information sharing framework as it relates to ACA is predicated on managing risk. While this is largely dependent on the use of assurances and caveats, investigators rely on the Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) assessment of the particular country or foreign entity in question. LOs/ADOs as part of their role, are expected to provide up-to-date information on current country and entity reports, relationships established with specific entities, and the RCMP’s history as it relates to information sharing and current human rights records. Investigators use this information to help inform a mitigation measure applied to a proposed information request, and/or disclosure.

In making assessments and providing recommendations to the Assistant Commissioner, FIRAC considers the specifics of the case included in the initial risk assessment (included in the FIRAC submission), the LEAG country assessment, as well as input from the Liaison Officers/Analysts Deployed Overseas (LO/ADO). A Record of Decision is completed after each meeting and highlights the history of sharing with the entities, the risks and mitigation measures discussed, and the final recommendation of the Committee. Based on the information provided in the Record of Decision and the recommendation of the committee, the Assistant Commissioner will then make a determination.

While the RCMP has not formalized a Gender Based Analysis within their ACA risk-related assessments, NSIRA notes that considerations applied in the RCMP’s country risk assessments identify vulnerable groups at risk of mistreatment under the “Human Rights Concerns for Specific Groups.” Individuals identified as at risk in a country/entity designated as medium risk would require a FIRAC assessment prior to any information exchanges.

NSIRA sampled twenty instances where FIRAC was convened. However, there were a number of cases where multiple FIRAC meetings pertained to the same case. For example, [**redacted**] which is examined in closer detail as part of the NSIRA’s sample file review, had three separate FIRAC meetings. The twenty FIRAC instances in the selected sample amount to sixteen individual cases. Requests made by NSIRA used the FIRAC nomenclature, and the RCMP fulfilled requests based on what was requested in the Requests for Information. The result was that NSIRA was only able to view case file information where the case was a touch point within the FIRAC process; the full operational case files were not provided.

NSIRA recognizes that the RCMP fulfilled its obligation when responding to our request for information. However, when it became clear that NSIRA had not obtained the entirety of the case, including the investigative file, significant time constraints prevented NSIRA from obtaining and considering the additional information in this review.

Outbound Information Sharing

NSIRA observed that in at least 35 percent of FIRAC cases sampled, the RCMP factored the potential for the negative impact of not sharing in their assessment. FIRAC’s assessment considers the risk of not sharing outbound information with a particular emphasis on maintaining, developing, or preserving a relationship with an information-sharing partner. Furthermore, the RCMP informed NSIRA that they will also consider the potential public risk to security of not sharing the information. NSIRA understands that the reliability of assurances and caveats depend crucially on the circumstances and the context of a particular case, but would strongly encourage the RCMP to base its rationale for sharing information primarily on the risk to the individual. NSIRA notes that the risk assessment and mitigating strategies (to minimize risk) are the primary tools to be used when assessing whether information is to be shared. The ACA and issued Orders in Council do not permit the weighing of external considerations such as relationship damage associated with not sharing information and public safety against the risk to the individual.

Mitigation and Assurance Measures

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

The RCMP advised NSIRA that any assurances or caveats that have or have not been adhered to in relation to information sharing with foreign entities are recorded within the investigative case file. The RCMP further explained that information is shared on a case-by- case basis by means of either the Liaison Officer responsible, or INTERPOL channels.

Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) are required to record their interaction in their notes which would be included within the operational investigative file. The RCMP has advised NSIRA these notes are where any violations of assurances or caveats would be recorded.

The RCMP explained that it relies on its overseas network to monitor the reliability of assurances and caveats, and that personnel meet regularly with law enforcement partners and foreign allied LOs. The RCMP further noted any indication of a deterioration in human rights within a country or specific report on mistreatment of an individual would be discussed and captured within the RCMP (operational) case file, and ultimately documented in the RCMP’s FIRAC risk assessment form.

As noted above, due to time constraints, NSIRA obtained information on FIRAC meetings and the supporting documents, and did not have an opportunity to review the RCMP’s operational case files. When NSIRA asked to provide rationales used to assess the reliability of assurances and caveats for the selected sample, NSIRA was referred back to the FIRAC risk assessment form (also known as Form 6517), and provided with the following:

The footnote highlights a number of case files. General and Supplementary reports on these files were reviewed in the preparation of this response. No concerns with respect to assurances were documented and only one instance with respect to caveats was identified. In this regard, [**redacted**] documents one instance wherein a partner agency had not adhered to a caveat’s requirement to coordinate actions – no allegation of mistreatment was documented on the file. The issue was raised with the partner agency and addressed.

NSIRA notes that while the [**redacted**] was in relation to a company operating in the [**redacted**], witness information was sought from the [**redacted**]. The LEAG Country Risk Assessment for [**redacted**], designated as medium risk, does cite an issue specific to the sharing of information and the use of caveats, but has not been updated since August 2018. The RCMP has advised that:

While the LEAG country assessment has not yet been updated, the LO would be expected to raise this issue in any future consultations with various investigative teams seeking to share with this entity.

NSIRA stresses the importance of the post-monitoring of assurances and caveats. NSIRA has observed that the issuance of an assurance, and/or caveat may sometimes rely on assurances provided by a specific official (within the foreign entity/country). Absent appropriate documentation, this may be problematic due to the fact that movement within positions is to be expected and assurances can no longer be valid if the individual has moved out of the position. Assurances must be followed up on and renewed to ensure they are being followed in the event of employee turnover.

Furthermore, there is no centralized process for the documentation of assurances. Rather, some documentation that is occasionally noted on specific investigative files may be problematic in situations where LOs/ADOs are rotational. If the investigative file is closed, the new LOs/ADOs to the post may not be aware of situations where assurances have not been respected.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Country and Entity Profiles

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In 2019, the RCMP conducted an internal review of its information sharing framework including LEAG and FIRAC. Based on this review, NSIRA recommended in 2019, that departments adopt internal reviews of their policies and processes as a best practice. While it is not the intention to cover items already identified in the (internal) review, NSIRA notes that three years have elapsed and the issues associated to country and entity assessments still remain.

Of the 90 assessments, the RCMP is currently using to base its risk assessments, 87 percent have not been updated since 2018, and the remaining thirteen percent have not been updated since 2019. Over the course of 2021, the RCMP did not update any of its country profiles. NSIRA has been advised that in 2022, [**redacted**] but cite funding constraints as a key challenge.

A key finding of the RCMP’s internal review relates composition of the profiles themselves, in that they: “do not sufficiently reflect the RCMP’s operational experience.” The review states that: “LEAG country and entity risk profiles are predominately based on open source information rather than input from operational units…” The RCMP through the course of the review emphasized the role and importance to the Liaison Officer during the FIRAC process, suggesting that the Liaison Officer is positioned to offset any shortcoming with the country and entity profiles. NSIRA notes the internal review highlights some of the challenges faced by the Liaison Officers, referring to the added responsibilities of the LEAG and the FIRAC processes as adversely affecting their ability to preform their regular duties.

NSIRA notes the RCMP’s ongoing efforts at improving its post-monitoring efforts. NSIRA looks forward to reviewing the progress made over the next year on the measures taken on updating the RCMP’s country profiles, and inclusion of post-monitoring of automating media monitoring and information sharing tracking mechanism with INTERPOL Ottawa.

Case Study: [**redacted**]

[**redacted**] the RCMP sought approval to interview a [**redacted**]

[**redacted**] The RCMP sought to [**redacted**] interview [**redacted**] in order to assess the current risk or threat [**redacted**] to Canada and Canadian citizens, [**redacted**]. The RCMP has advised that a “…successful interview could advance the investigation [**redacted**]and significantly improve the ability to identify the threat and risk [**redacted**] to [**redacted**] security.”

Additionally, the RCMP believed that “engagement with [**redacted**] may lead to [**redacted**] information and evidence [**redacted**].

[**redacted**]

The RCMP’s internal Country profile classifies [**redacted**] as a High-Risk Profile (RED). The profile notes serious documented allegations of human rights abuses [**redacted**] (but not limited to) torture [**redacted**] suspects routinely subjected to unfair trials. The RCMP had concerns that “If [**redacted**] could face torture and mistreatment [**redacted**]”. As per policy the case was escalated to the Foreign Information Risk Advisory Committee (FIRAC).

a) FIRAC [**redacted**]

[**redacted**], the FIRAC convened and discussed the request to interview [**redacted**] Committee found that there are substantial risks of mistreatment for [**redacted**] that there are currently no measures in place that could effectively mitigate the identified risks. FIRAC noted [**redacted**].

FIRAC did however also note, “that efforts should be made to better position possible future interviews.” They noted that [**redacted**] would “allow the RCMP to monitor the outcomes and assurances of discussions at a strategic level [**redacted**].

Accordingly, FIRAC recommended that the RCMP “engage in discussion [**redacted**] on the [**redacted**] potential for [**redacted**]. The Assistant Commissioner for [**redacted**] approved this recommendation.

Events of [**redacted**]

In response to the FIRAC recommendation, senior RCMP [**redacted**]

[**redacted**]

Based on [**redacted**] the investigative team sought FIRAC’s recommendation to allow [**redacted**] further discussions [**redacted**] in order to have the RCMP [**redacted**] interview with [**redacted**] and seek assurances [**redacted**].

[**redacted**]

[**redacted**], the FIRAC convened [**redacted**] to consider the request to engage and exchange information to [**redacted**] interview [**redacted**] to seek assurances [**redacted**]. The request was approved by FIRAC, if certain mitigation measures and assurances be received, [**redacted**].

Events of [**redacted**]

[**redacted**] RCMP [**redacted**] engaged the [**redacted**]. The RCMP [**redacted**] there is a [**redacted**] they would be interested in interviewing [**redacted**].

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

The RCMP [**redacted**] escalated the requests to interview [**redacted**] to FIRAC with additional mitigation measures.

[**redacted**]

[**redacted**]

FIRAC convened a meeting to discuss the request to share the personal information of [**redacted**].

The Committee concluded that there is a substantial risk of mistreatment [**redacted**] should the information be shared and that said risk cannot be mitigated by caveats and assurances. Accordingly, the Committee recommended that the information not be exchanged. This recommendation was based on the following concerns:

  • [**redacted**]
  • The existence of a significant risk of mistreatment that could not be mitigated [**redacted**].
  • Inability to guarantee [**redacted**]
  • Safety concerns based on information that may be derived from the interview;
  • [**redacted**]
  • [**redacted**]
  • Assurances were deemed insufficient to mitigate the risk, [**redacted**] to allow for an assessment of the confidence in the assurance.

FIRAC recommended [**redacted**] explore additional options to reduce the potential risk of mistreatment and then return to the committee for reconsideration. Among these options, the Committee suggested [**redacted**].

[**redacted**], the Assistant Commissioner [**redacted**] rejected FIRAC’s recommendation and allowed the sharing of information. He based his decision on the following:

  1. [**redacted**] the RCMP should consider the consequences of not sharing [**redacted**] as this would be detrimental for the relationship stating that “engagement [**redacted**] will give insight and influence”;
  2. [**redacted**]
  3. The importance of the RCMP maintaining a strong relationship [**redacted**].

The Assistant Commissioner then concludes, “failure to share presents risk that cannot be managed [**redacted**]. Although influence is not guaranteed, I believe it is the better choice”

A subsequent email by the Assistant Commissioner [**redacted**] outlined additional considerations that factored into the decision to reject FIRAC’s recommendations. These considerations focused on the risk of not sharing the information. The additional information included operational and strategic considerations [**redacted**]. The Assistant Commissioner stated that lack of engagement [**redacted**]. Strategically, the Assistant Commissioner noted the risk to relationship should the information not be shared, noting that “failure to follow through [**redacted**] and associated mitigation efforts articulated below will likely have a negative impact on the [**redacted**] relationship [**redacted**].

The Assistant Commissioner’s reasoning goes on to include a “necessity” analysis regarding the challenges [**redacted**] the importance of the information from the interview, and the importance of the relationship [**redacted**]. Of note, the Assistant Commissioner notes that [**redacted**] a strong relationship [**redacted**] will aid in plans to mitigate the greater risk while also managing the risk that exists today for the Canadian [**redacted**]. The Assistant Commissioner also concludes his email by stressing that it is his belief that sharing the information is required to reduce the risk of mistreatment [**redacted**] that lack of involvement will lead to greater risk.

Analysis

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated.”

The ACA and issued OIC place an absolute prohibition on the sharing of information where there is a substantial risk of mistreatment of an individual. Unless “officials determine that the risk can be mitigated, such as through the use of caveats or assurances and appropriate measures are taken to mitigate the risk”, the information cannot be disclosed. Section 1(2) of the OICs further stipulate, “that where officials are unable to determine whether the risk can be mitigated, the Commissioner must ensure that the matter is referred to the Commissioner for determination.

The Assistant Commissioner’s decision to share the information contrary to FIRAC’s recommendation, cites section 1(2) of the OIC and concludes that since the FIRAC is responsible for making a recommendation to the Assistant Commissioner then the Assistant Commissioner is the final decision maker. The Assistant Commissioner “made the decision that the risk can be mitigated.” The Assistant Commissioner did not consider that making the final decision in this instance ran contrary to the process set out in the FIRAC Terms of Reference, and contrary to the OICs. The OICs are clear, where officials are unable to determine whether the risk can be mitigated the matter must be referred to the Commissioner…” Accordingly, pursuant to section 1(2) of the OIC, NSIRA notes that this case should have been elevated to the Commissioner for determination.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

[**redacted**]

A number of assumptions characterize the justifications by the Assistant Commissioner to share the requested information.

[**redacted**]. However, this reasoning disregards [**redacted**]. It further dismisses the RCMP’s own reporting [**redacted**]. FIRAC’s record of decision which notes, [**redacted**]. The Assistant Commissioner accordingly disregards the possibility that [**redacted**].

In the alternative, the Assistant Commissioner relies on [**redacted**] but does not consider now the risk [**redacted**] may increase [**redacted**].

Secondly, the Assistant Commissioner’s reasoning relied on [**redacted**].

The Assistant Commissioner does not address FIRAC’s concerns for [**redacted**] the insufficiency of mitigation measures. Rather the Assistant Commissioner concludes [**redacted**] greater risk should the information not be shared – but does not explain why or how so? Nor does the Assistant Commissioner address FIRAC’s concerns regarding [**redacted**].

Additionally, the Assistant Commissioner’s decision considered and emphasized the importance of the relationship between the RCMP [**redacted**] While FIRAC expressed concern assurances would be respected. The Assistant Commissioner’s reasoning focuses on the importance of [**redacted**], that relationship [**redacted**].

As mentioned earlier, according to the RCMP:

“…while the ACA and OiC may not speak to external considerations, it does not prohibit strategic considerations as part of the totality of the analysis, rather than against the risk to the individual, including whether strategic partnerships may act as a mitigation measure. It is important to note that the ACA and OiC do not supersede our obligations under the RCMP Act.”

The RCMP further noted that: “…As such, any action or inaction could result in unwanted consequences, and to include them as a consideration to demonstrate due diligence, and that all aspects of an activity is considered is prudent. Strategic relationships, or more importantly, in this case, actions that jeopardize the strategic relationship, can lead to harm. The A/C clearly stated that.”

NSIRA notes that the assessment of mistreatment must be limited to whether the disclosure would result in a substantial risk of mistreatment to the individual and whether said risk may be mitigated. NSIRA strongly cautions against the use of additional considerations such as strategic relationships in the assessment of substantial risk.

It should be noted that the Assistant Commissioner did provide additional mitigation measures for consideration. However, those measures were all premised on [**redacted**]. The measures did not require that the assurances and the FIRAC suggested mitigation measures be adopted as a prerequisite to the information sharing.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Finally, in the case at hand the Assistant Commissioner responsible for approving the FIRAC recommendations was the same Assistant Commissioner supervising the business line of the case. In 2019 NSIRA recommended that “departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested in the outcome.” As discussed in paragraph 61 above, in 2021 the RCMP adjusted its FIRAC process such that there are co-chairs for the FIRAC. Adding an additional Chair (co-chairs) was to ensure that the Chair overseeing a specific FIRAC is not the one responsible for business line where the case originated. The case at hand demonstrates the need to emulate that structure at the senior level in order to maintain independent decision-making and ensure that the case focus is on the substantial risk of mistreatment to the individual rather than additional strategic considerations.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Global Affairs Canada

During the course of the review period from January 1, 2021, to December 31, 2021, six cases reported to having been referred to the Intelligence Policy and Programs Division (INPL) for further assessment. In the cases that were provided to NSIRA all were specific to Mission security, where Missions were dependent on local authorities to assist in situations where there was a potential threat to staff at the embassy or consulate. When asked about the low number of cases, GAC advised NSIRA that sharing personal identifying information with foreign entities was very rare in an ACA context.

Implementation of the ACA

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

On December 14, 2017, GAC was issued Ministerial Direction on Avoiding Complicity in Mistreatment by Foreign Entities (2017 MD). GAC had not received the Ministerial Direction on Information Sharing with Foreign entities (the 2011 MD) that was issued to a number of other departments.

The department manages a global network of over 175 missions in 110 countries, employing approximately 12,000 staff with an operating with a budget of over $7 billion.

When asked how the department operationalizes the Act, GAC referred to their outreach and training programs. GAC advised NSIRA that their training programs targeted specific staff to ensure awareness of and compliance with the ACA. The training outlines the roles and responsibilities regarding the ACA and Orders in Council requirements, and provides employees a definition of “substantial risk,” and points of contact at headquarters.

In 2021, NSIRA committed to further scrutinizing the processes regarding ACA triage and decision-making by reviewing both GAC and the RCMP. In the 2020 ACA review, NSIRA found that there were significant divergences in the evaluation of risk and required level of approvals across departments. In particular, NSIRA identified procedural gaps in GAC’s risk assessments that should have warranted escalation to the Deputy Minister.

When asked if GAC had initiated any adjustments, or changes to frameworks or policies as a result of the findings and recommendations from previous reviews of the ACA, GAC advised that adjustments had been made to the framework by creating a Mistreatment Risk Assessment form. They explained that the form would support the application of a more consistent threshold for elevating a case in the decision-making process, and would standardize how cases are documented. As of August 31, 2022, GAC has yet to implement the use of this form.

Currently, the Head of Mission (HoM, or Chargé) makes the initial assessment in determining if the risk of mistreatment to the individual may be mitigated below the substantial risk threshold. Only where the HoM identifies a concern as to the sufficiency of the mitigation measures or assessment, would the HoM seek guidance through the Intelligence Policy and Programs Division (INPL) generic e-mail.

INPL can assist the Mission in conducting a risk assessment. If at this point it is determined there is a substantial risk of mistreatment that cannot be mitigated and the Mission still wants to proceed, the responsible geographic Director General may request that the Avoiding Mistreatment Compliance Committee (AMCC) be convened. The AMCC provides a decision to the HoM. GAC has advised that the role of the AMCC:

….is to recommend risk-mitigation strategies, seek escalatory senior-level discussion and approval for decisions as required, up to and including the Deputy Minister of Foreign Affairs, and document how each case is managed. It is convened on an ad hoc basis to review the proposed disclosure, request, or use of information in cases in which prohibitions under the Directions may be engaged. The Committee is similar to structures that exist within other departments and agencies subject to the OiC.

In 2020 and 2021, GAC initiated a review of the Secretariat of the AMCC, formerly known as the Ministerial Direction Compliance Committee (MDCC). GAC has advised that notional recommendations have been developed to improve the working methods of the Committee and update the terms of reference. Explaining that the timeliness of Committee decisions, addressing duty of care issues, and final reporting of case outcomes regarding Committee decisions are currently being examined. It is expected that the AMCC Secretariat’s review will be completed in 2022 and the terms of reference updated shortly thereafter.

In the six cases provided over the review period, NSIRA observed that the final decision on whether to share information with local authorities was left to the HoM. This is best illustrated in the HANOI case where the mission was advised

To note, decision-making authority on such situations ultimately rests with mission/geo. INPL’s role—as departmental focal point for the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA)—is simply to advise on relevant considerations, not authorize.

In further correspondence between INPL and the Mission in Hanoi there appears to be the need for additional clarification on the decision-making roles in regards to applying the ACA. INPL further advised the Mission that “it is in fact the Mission’s responsibility to determine if there is a substantial risk of mistreatment or not.

The centralization of accountability with the HoM as opposed to headquarters represents a significant change in implementation since NSIRA’s in-depth review of GAC in 2019. Namely, in the previous review any cases where there was a potential substantial risk of mistreatment would require escalation MDCC (via the INPL) where the Committee would ultimately be responsible for deterring if the proposed mitigation measures are sufficient and if the information sharing should take place. This change in implementation threatens the independence of the process from individuals with a potential operational interest in the outcome of the information sharing.

Recommendation 5: NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Information Sharing Framework

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

GAC does not have any information-sharing arrangements with foreign entities related to the ACA. When asked in last year’s review how GAC monitors its information exchanges, the response provided reads as follows:

There is a handful of divisions at GAC that receive information that may have been obtained through mistreatment. Because of the very different type of information they each receive due to their specific mandates, each has a different process/framework for identifying information likely to have been obtained through the mistreatment. Therefore, there is not one unified set of processes at GAC for initially marking/identifying incoming information potentially derived from mistreatment.

GAC has also not conducted an internal mapping exercise to determine which business lines are subject to the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

When asked to elaborate on the nature of information exchanges triggering the ACA, GAC further clarified:

[T]hat information exchanges occur without formal arrangement with foreign entities, and the vast majority of the information that is exchanged does not pertain to individuals. Each information exchange situation is unique and occurs within a specific relational and country context.

Each instance of information sharing is handled on a case-by-case basis and escalated to the appropriate level based on the individual circumstances.

It is important to note that if the assessment determines that there is NOT a substantial risk of mistreatment, but that the exchange of information directly or indirectly involves personally identifiable information about an individual AND the country or foreign entities is not a trusted partner when it comes to human rights, GAC employees must still capture via a risk assessment form the reason why there is NOT a substantial risk of mistreatment and keep a thorough record.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

When determining whether there is a risk of mistreatment, GAC employees will leverage human rights reports, as well as any intelligence relevant to the country/entity associated with the information. The risk profile of the individual about whom information is shared is also taken into consideration when making a determination regarding whether a substantial risk of mistreatment exists. It is a collection of information that informs any assessment and respective decision, rather than a single tool.

Training is only mandatory for employees working in a high-risk mission or functions and offered as a suggestion for other staff at mission and headquarters. GAC has committed to establishing a dedicated ACA page on the intranet, along with supporting communication, however, employees are only encouraged to review it.

GAC provides an outreach program and training, for staff both at headquarters and at missions abroad on their ACA obligations. The ACA components are embedded in GAC’s Governance, Accreditation, Technical Security and Espionage (GATE) awareness program, the Legal and Policy Framework on Information Sharing, and a module in the Heads of Mission pre-posting training. These training courses outline the roles and responsibilities of officials regarding their ACA and Orders in Council obligations, including the definition of “substantial risk”, and key points of contact at headquarters. It is important to note that the GATE awareness program and that the ACA segment of the training is considered as an outreach tool and not a core training module, meant to provide situational awareness for Canadian- based staff on information security and intelligence topics. The training provided by the Department of Justice acts as the core training module for staff.

When asked about Consular Operations bureau training, GAC appeared to have only a cursory knowledge citing that they were aware from the 2021 Annual Report (on the Application of the Orders in Council Directions for Avoiding Complicity in Mistreatment by Foreign Entities) that ACA directions were included as part of the training session offered by the Consular Operations bureau.

The target employees for training at headquarters are outgoing Mission Security Officers, Management Consular Officers, Readiness Program Managers, Global Security Reporting Program Officers and Heads of Mission, as well as all members of the Intelligence Bureau. At mission, the training is provided to all Canada-based staff, including other government departments’ employees posted at missions. GAC has only recently begun tracking the number of staff that have been provided ACA training, and estimates that at least 300 GAC employees have been provided ACA-related training since 2020.

When further queried about the breakdowns of training provided, GAC posited that there are only a small proportion of GAC officers abroad that may encounter ACA-related decisions. With training only mandatory for some staff, NSIRA is concerned that given the volume of information exchanges, and the multiplicity of business lines there is very well potential that information sharing may be occurring, or not properly triggered by those without proper ACA knowledge.

In light of the fact that GAC engages with foreign entities with poor human rights records and operates in highly volatile environments, NSIRA expresses deep concern that GAC has not demonstrated that it has implemented ACA framework across business lines.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Human Rights Reporting

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

GAC develops classified human rights reports making them available to a number of internal Government of Canada partners. These reports are intended to provide an overview of the human rights situation of a particular country. They help inform Canada’s international engagement and programming decisions, including foreign policy, development, trade, security, and consular activities. Updated human rights reports (post 2019) include a designated section that addresses the Orders in Council and the ACA, and the circumstances of mistreatment within that country.

The coming into force of the ACA and the issuance of the Orders in Council resulted in a greater number of departments being subject to directions specific to the avoidance of mistreatment by foreign entities. Many of these departments did not have frameworks or any country assessments to support this obligation. This created an increased demand for the GAC Human Rights Reports.

Prior to Royal Assent of the ACA, GAC provided human rights reports to departments that were subject to the 2017 Ministerial Directives. GAC also works with partners to incorporate feedback on human rights reporting and considers input on countries of interest for subsequent reporting cycles. It is important to note that GAC does not keep statistics on how often, or which reports were requested/accessed by internal partners.

NSIRA recognizes that in 2021 GAC has recently implemented a prioritized list to update the human rights reports and has been making considerable headway during the review period, updating 25 percent of their profiles. A number of high-risk countries have been updated to reflect current events. Still, a number of reports are outdated and close to 60 percent of the 133 human rights reports have not been updated since 2019. For example, Pakistan, Somalia, Ukraine, and Yemen have not been updated since 2019, while South Africa and Belarus have not been reviewed since 2015.

Maintaining up-to-date reports will help ensure that critical human rights information is being used when making ACA determinations, this is especially vital considering that other department leverage GAC’s human rights report as part of their risk assessments. NSIRA notes that the Information Sharing Coordination Group coordinated by Public Safety Canada continues to work through the prioritization and the issues associated with the sharing of human rights reports across departments. It should be stressed that the GAC human rights reports are viewed as a supplement to what departments have already collected as part of their own assessments. For this reason GAC does not provide evaluative judgment on risk within their human rights reports, that is they do not designate whether a country or entity is high or low risk, consequently leaving departments to assess risk based on the information they have collected as part of their mandates.

NSIRA has been advised that the GAC country priority list was developed in consultation with partner departments and agencies, and relevant GAC divisions. And is based on an assessment of the operational needs of Canadian federal departments and agencies. While understanding the impact the pandemic had on operations, particularly at Missions abroad, NSIRA encourages GAC to develop, maintain, and continue to work with other departments and agencies to ensure countries’ HRRs are updated as regularly as possible.

Development of Human Rights Reports

GAC produces human rights reports in collaboration with its missions. Coordinated by GAC’s office of Human Rights, Freedoms and Inclusion directorate, the reports are used not only to inform risk assessments, but assist in the guidance of policy and programming decisions.

Missions are responsible for updating their human rights reports, and, if tasked, are linked to Head of Mission’s performance measurement agreements. Mission staff work collaboratively with geographic branches in the preparation of the reports. While headquarters is responsible for the tasking and coordination of the reports, it is Head of Mission that approves the report. The reports include information on the overall human rights context in the country, as well as an analysis of the significant human rights-related events that took place during the review period. Generally, reports are a collection of various sources, which include open source reporting, consultations with human rights organizations and civil society partners, and engagement with government authorities and stakeholders.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Assurances

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

GAC advised that there was no standardized approach in place to assess the reliability or document assurances received from foreign entities. Risk assessments are conducted on a case-by-case basis. When asked how assurances were developed, GAC stated that there was no statutory or regulatory language that specifically addressed the use of diplomatic assurances, but officials implicated in individual cases would consider the foreign entity’s credibility, recent precedents, the experiences of like-minded partners, and the feasibility of monitoring assurances and caveats to be communicated with the disclosure. It is the Mission’s responsibility to track and monitor whether assurances and caveats are being respected

NSIRA noted that on the ATHENS case provided by GAC, there was a concerted effort to ensure assurances and caveats were in place before information was shared with local authorities. It is in NSIRA’s opinion that the mission was attuned to their obligations under the Act (and directions) and tried to ensure the welfare of the individual detained by authorities. [**redacted**] Mission staff took remedial action to ensure that the individual is not at risk of mistreatment.

In the ATHENS case, [**redacted**]. NSIRA noted that there is no formalized tracking, or documentation mechanism for the follow-up caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix I: Findings and Recommendations

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework and supporting policies and procedures are still under development.

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment is a best practice.

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated”.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Recommendation 5 : NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix II: ACA Framework and Background

It is important to note how the legal frameworks have evolved over the past decade. In international law Canada is a state party to a number of international instruments including the International Covenant on Civil and Political Rights (ICCPR), and the Convention Against Torture and Other Cruel, Inhumane or Degrading Treatment or Punishment (CAT). Many of the prohibitions on mistreatment, in these conventions are now considered customary international law. These international commitments have been implemented in Canadian domestic law; most notably the prohibition on torture is clearly defined and codified in the Criminal Code under section 269.1.

In 2010, the Canadian Government implemented a general framework for “Addressing the Risks of Mistreatment in Information Sharing with Foreign Entities”. This was the first multidepartment instruction given by the government regarding the issue of information sharing and mistreatment.

The framework was followed by two detailed Ministerial Directions to departments in 2011 and 2017. The 2017 MD was issued to seven departments and created prohibitions on the sharing of information that may lead to a substantial risk of mistreatment that cannot be mitigated. The MD also provided clear parameters on the use of information potentially derived from mistreatment. Additionally, the MD broadened the scope of applicability to all information sharing with foreign entities and not just that pertaining to national security issues.

On July 12, 2019, the Avoiding Complicity in Mistreatment by Foreign Entities Act came into force. The Act codifies and enshrines Canada’s commitment to respect the Charter of Rights and Freedoms, and the international agreements prohibiting torture and other cruel, inhuman or degrading treatment or punishment that it is party to. A primary objective of enshrining these principles through statute rather than the previous use of Ministerial Directions was to ensure that Canada’s commitment to these principles does not rest with the Minister or Government in power. The ACA provides the statutory authority for the Governor in Council (GiC) to issue directions through Orders in Council. The Act imposes an obligation on the GiC to issue Orders in Council to at least seven specific departments. In September 2019, there were in total 12 Orders in Council issued to departments and agencies engaged in information sharing with foreign entities.

The Orders in Council prohibits the disclosure of information to any foreign entity where said disclosure would result in a substantial risk of mistreatment of an individual and prohibits the making of any requests to any foreign agency for information that would result in a substantial risk of mistreatment of any individual. Additionally, the issued Orders in Council places parameters on the use of information likely derived from mistreatment of an individual by barring its use where it may create a substantial risk of further mistreatment, as evidence in any judicial, administrative or other proceeding, or in any way that deprives someone of their rights and freedoms (unless determined by the deputy head that it is necessary to prevent loss of life or significant personal injury).

Ministerial Direction (2011)

  • Issued to CSIS, CSE, CBSA and RCMP;
  • DND developed similar internal instruction; but was not issued as a ministerial direction (functional directive); and,
  • Main criticism was that departments were permitted to weigh the value of the information against the risk of mistreatment

Ministerial Direction (2017)

  • Addition of GAC, and DND (to CSIS, CSE, RCMP, CBSA);
  • A number of changes, most significant were prohibitions of the disclosure and requesting of information, as well as new limits on the use of information (derived from mistreatment);
  • Requirement for departments to maintain policies and procedures to assess risks; and,
  • Inter-agency co-operation requirement

OiCs issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (2019)

  • Issued to twelve departments, six of which had never before received formal direction regarding information sharing with foreign entities (PS, FINTRAC, TC, IRCC, CRA and DFO); and,
  • Codified many provisions of the 2017 MD

As noted in the introduction, the legal framework governing the sharing of information with foreign entities applies to information pertaining to all individuals, regardless of whether they are detainees or not. There is currently no government-wide implementation policy for the ACA. However, the issued Orders in Council do provide guidance on the requisite threshold for information sharing and the requisite hierarchy of approval where there is uncertainty as to whether mitigation measures may sufficiently diminish the substantial risk of mistreatment. Public Safety Canada in 2018, set up an Information Sharing Coordination Group with the objective of sharing best practices between departments.

Individual departments develop their own internal framework and policies for the implementation of the ACA. Some departments that were previously subject to the MDs on Avoiding Complicity in Mistreatment by Foreign Entities had a greater opportunity to create internal processes, procedures and policies to identify when information sharing practices may create a substantial risk of mistreatment. These departments have developed structured approaches to recording assurances (verbal or written) received from the foreign entities whom they engage and possible mitigation strategies such that the threat is diffused below the substantial risk of mistreatment threshold.

Appendix III: Previous Recommendations

Past findings and recommendations
Report for Year 2018 Report for Year 2019 Report for Year 2020
Finding #1: Benefits of internal information sharing process reviews. NSIRA noted that periodic internal reviews of information sharing policies and processes supported their successful functioning in the long term. Finding #1: NSIRA found that several departments, new to the considerations of the Act, described considerable progress being made during the review period and afterwards to build out formalized frameworks to support implementation. Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.
Recommendation #1: Departments should conduct periodic internal reviews of their policies and processes for sharing information with foreign entities in order to identify gaps and areas in need of improvement. Finding #2: NSIRA found that departments conducting minimal information exchanges with foreign entities have not yet fully addressed the importance of having an official information sharing framework in place. Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.
Findings #2: Departments vary with respect to the independence of their decision-making. NSIRA examined the extent to which high-risk decision-making is removed from operational personnel who may have vested interest in the sharing. In some departments, the decision-makers have a direct operational interest in the sharing of information, creating the potential for conflict between operational imperatives and departmental obligations to respect the MD. In particular, NSIRA noted that:
  • CSE and the RCMP have the most independent processes.
  • The information sharing process implemented by GAC to date remove high-risk decision-making from “front line” personnel.
  • At CSIS and DND/CAF, decision makers typically have a direct operational interest in the sharing of information.
  • CBSA has not yet operationalized its information sharing processes.
Recommendation #1: NSIRA recommends that all departments in receipt of directions under the Act have official framework that ensure they can fully support the implementation of the directions. Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.
Recommendation #2: Departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested the outcome. Finding #3: NSIRA found that the differences and variability in departmental frameworks demonstrate a previous lack of coordination across the community and a need to identify best practices. Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.
Finding #3: Lack of standardized information sharing risk assessments. Under the 2017 MD, GAC, CSIS, CSE, and the RCMP all maintain their own sets of foreign country and/or entity profiles, while DND/CAF is currently developing its own as well. The existence of multiple different assessments is duplicative and unnecessary. It may also yield inconsistencies, as departments have at times come to quite different conclusions about foreign countries’ and entities’ human rights records and the associated risks of information sharing. Recommendation #2: NSIRA recommends that departments coordinate to identify best practices for all essential components of information sharing frameworks and that ISCG is leveraged to ensure these practices are shared where possible across the community to support the implementation of the Act.
Recommendation #3: Departments should develop:
  • Unified set of assessments of the human rights situation in foreign countries including a standardized ‘risk of mistreatment’ classification level for each country; and
  • To the extent that multiple departments deal with the same foreign entities in a given country, standardized assessments of the risk of mistreatment of sharing information with foreign entities.
Finding #4: NSIRA found that there are inconsistencies in the application of existing sharing frameworks between departments, specifically concerning information evaluation thresholds, and decisions being elevated for senior level determinations.
Finding #4: The concept of “substantial risk” of mistreatment is not defined. Like the 2017 MD, the ACMFEA and its associated direction prohibit information sharing that would result in a “substantial risk” of mistreatment, Neither the ACMFEA nor its direction include a definition of substantial risk, however, despite the centrality of this concept to the regime. A definition of substantial risk existed in both the 2011 and 2017 MD; its absence now raises concerns about its interpretation in the future. Recommendation #3: NSIRA recommends that departments establish consistent thresholds for triggers in their information sharing frameworks, including initial evaluations against the concerns of the Act, when a case is to be elevated in the decision process, and how this is documented.
Recommendation #4: The definition of “substantial risk” should be codified in law or public direction. Finding #5: NSIRA found a lack of unification and standardization in the country and entity assessments being leveraged by departments, resulting in inconsistencies in approach/stance by the community when interacting with Foreign Entities of concern related to the Act.
Recommendation #4: NSIRA recommends that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the Act.

Annex A: Departmental Frameworks

Royal Canadian Mounted Police

Following receipt of the 2017 MD, the RCMP established a new Law Enforcement Assessment Group (LEAG). LEAG has a detailed Terms of Reference that outlines its membership as well as roles and responsibilities. LEAG’s primary task is to assess foreign countries and law enforcement entities with regard to the risk of mistreatment. In its assessments, LEAG considers a number of factors, including the human rights record of the country, specific foreign entities’ engagement in human rights abuses, local law enforcement’s history of respecting caveats, as well as country-specific risks to individual safety related to political views, religion, ethnicity, sexual orientation, and so on. LEAG thus “plays an integral role in informing FIRAC’s decision on whether to share information with foreign law enforcement entities.”

At present, the RCMP has categorized 146 approved country profiles, of which 20 are high risk, 69 are medium risk, and 57 are low risk. 51 country assessments remain outstanding. LEAG currently intends to update its profiles every two years, although LEAG will update some reports more frequently based on operational requirements. To date, 40 countries have been assessed as being a high priority for periodic updates due to the volume of information sharing conducted.

Graphic of FIRAC Process

Process

If an RCMP officer identified a need and wishes to share information with a foreign entity, they must follow a set process:

The officer must first consult a specific RCMP intranet website created by LEAG. The site lists countries by colour. If the officer finds that the country in question is “green”, he or she may proceed to share the information. If the country is “red”- or “yellow” and the circumstances of the proposed sharing match any of the case-specific factors and considerations listed- then the case must be referred to FIRAC. If a FIRAC is required, the officer completes a standard form which must be approved by the relevant Criminal Operations (CROPS) Officer or other approving officer. The form includes a summary of the information to be shared, the kind of sharing (request, disclosure or use), the operational context, the risks of sharing information, the investigative value of the information, possible mitigation strategies, and- where applicable- the actual information to be disclosed or used.

Once approved, the form is sent to the Director General (DG) responsible for the relevant program at RCMP headquarters for approval. Following approval, the DG submits the form to the FIRAC secretariat.

The FIRAC secretariat compiles a briefing package that includes the officer’s form, the country profile from LEAG, and any supporting documentation submitted by the DG. The briefing package is distributed to FIRAC members ahead of the meeting.

A FIRAC meeting is convened and the request is considered along with possible mitigation strategies. While the final decision regarding FIRAC’s recommendation rests with the Chair, in the vast majority of cases the decision is unanimous. Dissenting opinions are recorded in the Record of Decision (RoD). Once FIRAC has noted its recommendation, the RoD and an accompanying briefing note are sent to the Assistant Commissioner for final determination.

In cases where FIRAC cannot determine whether a substantial risk of mistreatment can be mitigated, the responsible Assistant Commissioner will provide the RoD to the Deputy Commissioner in order to obtain the Commissioner’s decision.

Global Affairs Canada

Framework Updates

Global Affairs Canada (GAC) indicated that no changes to their framework was made during the current review period.

Annex I: Global Affairs Canada Framework

Process

Triage

There is not one unified set of processes at GAC for determining whether information being used by the department is likely to have been obtained through the mistreatment of an individual by a foreign entity. If an official determines that information that he or she has received is likely to have been obtained through the mistreatment of an individual by a foreign entity and that official still wants to use the information, they are instructed in their training to consult with their Program management at HQ. Should that manager be unable to make a determination on their own as to whether the use would comply with the Act, they will consult the relevant departmental policy group and the department’s Legal Services Unit.

Senior Management Committees

The Avoiding Mistreatment Compliance Committee (AMCC) meetings focuses on the following:

  • Has the information, the use of which is being sought, likely been derived from mistreatment?
  • What are the proposed measures to mitigate the risks? What is the likelihood of their success?
  • Consider the justifications for and proportionality of any potential involvement with the foreign state or entity that may result in mistreatment.

The AMCC Secretariat will create a record of decision and circulate it for comment by AMCC members. Once finalized, it will be kept by the Secretariat for future reporting. The AMCC Secretariat follows up with the requesting official for updates on the outcome of the situation and requests a final update from the requesting official once the situation is resolved.

Global Affairs Canada’s human rights reports provide an evidence-based overview of the human rights situation in a particular country, including significant human rights-related events, trends and developments and include a section focused on mistreatment. There are no scores for countries however, and it is up to the officials to assess the risk based on the information in the reports.

Mitigation Measures

The Legal Services Unit and/or Intelligence Policy and Programs division will provide guidance on the limitations and the prohibitions of the use of information obtained through mistreatment. They are also able to propose potential mitigation measures, such as sanitization of the information, if there is a risk of further mistreatment; of depriving someone of their rights or freedoms; or if the information could be used as evidence in any judicial, administrative or other proceeding.

Share this page
Date Modified:

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: Minister of Foreign Affairs Responses

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021


Responses

Date of Publishing:

Share this page
Date Modified:

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021: Report

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021


Report

Date of Publishing:

List of Acronyms

Abbreviation Expansion
2017 MD 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities
ACA (ACMFEA, or “the Act”) Avoiding Complicity in Mistreatment by Foreign Entities Act
ADM Assistant Deputy Minister
AMCC Avoiding Mistreatment Compliance Committee
CBSA Canada Border Services Agency
CRA Canada Revenue Agency
CRCC Civilian Review and Complaints Commission for the RCMP
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DFO Department of Fisheries and Oceans
DND/CAF Department of National Defence / Canadian Armed Forces
EPPP Enhanced Passenger Protect Program
FINTRAC Financial Transactions and Reports Analysis Centre of Canada
FIRAC Foreign Information Risk Advisory Committee
FPNS Federal Policing National Security
GAC Global Affairs Canada
GATE Governance, Accreditation, Technical Security and Espionage
HOM Head of Mission (or Chargé)
HRR Human Right Report
ICCPR International Covenant on Civil and Political Rights
ICE Integrated Collaborative Environment
INPL Intelligence Policy and Programs Division
IRCC Immigration, Refugees and Citizenship Canada
ISCG Information Sharing Coordination Group
LEAG Law Enforcement Assessment Group
LO Liaison Officer
MDCC Ministerial Direction Compliance Committee
NSICOP National Security and Intelligence Committee of Parliamentarians
NSIRA National Security Intelligence Review Agency
OiC Orders in Council
PPP Passenger Protect Program
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
RFI Requests for Information
TC Transport Canada
Abréviation Développement
AL Agent de liaison
AMC Affaires mondiales Canada
ARC Agence du revenu du Canada
ASFC Agence des services frontaliers du Canada
CANAFE Centre d’analyse des opérations et déclarations financières du Canada
CCDM Comité de conformité à la directive ministérielle
CCEMT Comité de conformité pour éviter les mauvais traitement
CCETP Commission civile d’examen et de traitement des plaintes relatives à la GRC
CCRIE Comité consultatif sur les risques – Information de l’étranger
CDM Chef de mission (ou chargé de mission)
CPSNR Comité des parlementaires sur la sécurité nationale et le renseignement
CST Centre de la sécurité des télécommunications
DC Décret en conseil
DI Demande d’information
ECI Environnement collaboratif intégré
GASE Gouvernance, accréditation, sécurité technique et espionnage
GCER Groupe de coordination d’échange de renseignements
GEAL Groupe d’évaluation de l’application de la loi
GRC Gendarmerie royale du Canada
IM-2017 Instructions du ministre de 2017 visant à éviter la complicité dans les cas de mauvais traitements par des entités étrangères
INPL Direction des politiques et des programmes liés au renseignement
IRCC Immigration, Réfugiés et Citoyenneté Canada
Loi visant à éviter la complicité, la Loi Loi visant à éviter la complicité dans les cas de mauvais traitements infligés par des entités étrangères
MDN/FAC Ministère de la Défense nationale/Forces armées canadiennes
MPO Ministère des Pêches et des Océans
OSSNR Office de surveillance des activités en matière de sécurité nationale et de renseignement
PIDCP Pacte international relatif aux droits civils et politiques
PPP Programme de protection des passagers
PPP-A Programme de protection des passagers amélioré
RDP Rapport sur les droits de la personne
SCRS Service canadien du renseignement de sécurité
SMA Sous-ministre adjoint
SNPF Sécurité nationale et Police fédérale
SP Sécurité publique Canada
TC Transports Canada

Executive Summary

This review focuses on departmental implementation of directions received through the Orders in Council (OiC) issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”). This is NSIRA’s third annual assessment of the statutorily mandated implementation of the directions issued under the ACA.

This year’s review covers the 2021 calendar year and has been split into three sections. First, the review addresses the statutory obligations of all departments. Sections two and three of the review focus on in-depth analysis of how the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC) have implemented the directions under the ACA. NSIRA has used case studies, where possible, to examine these departments’ implementation of the ACA framework.

NSIRA has observed that this is the third consecutive year where there have been no cases referred to the deputy head level in any department. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Future reviews will be attuned to the issue of case escalation and departmental processes for decision-making.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

In last year’s review NSIRA identified Canada Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies. While CBSA and PS continue to make advancements these departments still have not fully implemented an ACA framework and supporting policies and procedures.

RCMP has a robust framework in place for the triage and processing of cases pertaining to the ACA. The in-depth analysis portion of this review found that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances. NSIRA also found that the RCMP has not developed mechanisms to update country and entity profiles in a timely manner, and the information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In the analysis of one of the RCMP’s Foreign Information Risk Advisory Committee (FIRAC) case files, NSIRA found that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments. The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested.

NSIRA found that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA. This is a marked change from the findings of the 2019 review that found decision-making was done at the Ministerial Direction Compliance Committee (MDCC) at Headquarters.

GAC has also not conducted an internal mapping exercise to determine which business lines are most likely to be implicated by the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

NSIRA also notes that GAC has no formalized tracking, or documentation mechanism for the follow-up of caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

During the review, GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC has provided NSIRA with all documents requested within a reasonable time frame.

This review assessed departments’ implementation of the directives received under the ACA and their operationalization of frameworks to address ACA requirements. As such, this review constitutes the first in-depth examination of the ACA within individual departments.

Authorities

This review is being conducted under the authority of paragraph 8(2.2) of the National Security Intelligence Review Agency Act (NSIRA Act), which requires National Security Intelligence Review Agency (NSIRA) to review, each calendar year, the implementation of all directions issued under the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA, ACA, or “the Act”).

Introduction

This review will focus on departmental implementation of directions received through the Orders in Council issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act. The overarching objective of this review is to assess whether departments are meeting their obligations under the ACA and associated directions. NSIRA is mandated to conduct this review on an annual basis.

Background

Many departments and agencies in the Government of Canada routinely share information with foreign entities. Given that information sharing with entities in certain countries can result in a risk of mistreatment of individuals, it is incumbent upon the Government of Canada to evaluate and mitigate the risks that such sharing creates. This is particularly the case for information sharing related to national security and intelligence, where information often relates to alleged participation in terrorism or other criminal activity.

The 2017 Ministerial Direction on Avoiding Mistreatment by Foreign Entities (2017 MD), defined the substantial risk of mistreatment as:

[A] personal, present and foreseeable risk of mistreatment. In order to be ‘substantial’, the risk must be real and must be based on something more than mere theory or speculation. In most cases, the test for substantial risk of mistreatment will be satisfied when it is more likely than not that there will be mistreatment; however, in some cases particularly where there is a risk of severe harm, the ‘substantial risk’ standard may be satisfied at a lower level of probability.

This review will be NSIRA’s third annual assessment of the implementation of the directions issued under the ACA. This review will build on the previous reviews conducted in respect of avoiding complicity in mistreatment. The first review was in respect to the 2017 MD. The second review assessed the directions issued under the ACA, but was limited to the four months from when the directions were issued to the end of the 2019 calendar year. The third review was NSIRA’s first full year assessment of the implementation of the directions issued under the ACA for the 2020 calendar year.

NSIRA has focused on conducting in-depth reviews of how departments implement the directions under the ACA. This approach builds on the foundational knowledge obtained over the last three years and reviews how departments operationalize the directions under the ACA by using case studies to assess departments ACA frameworks in practice.

The review, covering the 2021 calendar year has been split into three sections. The first section addresses NSIRA’s statutory obligations covering a full year review of all departments. This year NSIRA conducted an in-depth review of two departments: the Royal Canadian Mounted Police (RCMP) and Global Affairs Canada (GAC), sections two and three respectively.

Methodology

Subsection 7(1) of the ACA imposes a statutory obligation on the deputy head to whom directions were issued to submit a report to the Minister regarding the implementation of those directions during the previous calendar year and publish a public copy of the report. The Minister must then provide the classified copy to NSIRA.

The obligations for departments noted above are mirrored in the NSIRA Act. Under subsection 8(2.2) of the NSIRA Act, NSIRA must, each calendar year, review the implementation of all directions issued under the ACA. Additionally, NSIRA has the statutory right to review the implementation beyond the specific requirements of the ACA, namely through its mandate to review any activity carried out by a department that relates to national security or intelligence.

The issued Orders in Council (OiC) include a reporting requirement, whereby decisions necessitating referral to the deputy head for determination must be reported to the Minister and subsequently the review bodies. This requirement creates additional accountability for decisions undertaken by departments and allows NSIRA to be informed of any potential issues outside of the annual reporting cycle.

This review encompasses the implementation of the directions for the 12 departments that were in receipt of the OiC pursuant to the ACA. The review period is January 1, 2021, to December 31, 2021. Additionally, NSIRA has selected two departments for more in-depth case study review: GAC and the RCMP. NSIRA will ensure that additional departments are selected for case study analysis in future years.

In completing this review, NSIRA considered legal authorities and governance frameworks. NSIRA also relied on documentation and information obtained through briefings with the departments.

Verification of Information and Responsiveness

NSIRA conducted a review of all twelve departments by examining relevant policy and legal frameworks as communicated by the departments.

The RCMP was responsive to NSIRA’s requests, providing documents and briefings within agreed time frames. Due to timing constraints, NSIRA relied heavily on the written record as provided. NSIRA found that overall, its expectation for responsiveness by the RCMP during this review were met.

GAC demonstrated a willingness to provide NSIRA with the information requested, and made every effort to clarify requests. GAC was timely in their responses and provided access to people and information as requested. NSIRA found that overall, its expectation for responsiveness by GAC during this review were met.

All Departments

Framework Updates and Reporting

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework, and supporting policies and procedures are still under development.

Based on submissions to NSIRA, ten departments have established frameworks and policies addressing whether the disclosure of information to a foreign entity would result in a substantial risk of mistreatment of an individual. The submissions provided to NSIRA by Canada Revenue Agency (CRA), Department of National Defence / Canadian Armed Forces (DND/CAF), and Transport Canada (TC) indicate that they are actively working on refining existing policies and frameworks. NSIRA, in last year’s report identified Canadian Border Services Agency (CBSA) and Public Safety Canada (PS) as not yet having finalized their ACA policies.

Frameworks

CBSA advised that it has provisionally approved a framework for deciding whether a request for information from a foreign entity would result in a substantial risk of mistreatment of an individual. CBSA advised NSIRA that it issued direction to conduct an internal review with the goal of confirming the feasibility of operational implementation across multiple program areas.

PS has advised that a full suite of risk assessments are under development and that it intends to conduct information sessions to ensure other program areas not directly affected by the ACA are aware of information sharing obligations. PS also advised that the program area implicated by the Ministerial Directions (the Directions) has operationalized the policy and has ensured that their procedures and processes align with the requirements outlined in the departmental policy, Act and the Directions. These policies came into effect in January 2022, with “a few aspects” having not yet been finalized. The suite of risk assessments is still in development.

PS also intends to hold information sessions with various sections of the department that may not currently need to apply the Directions, but should nonetheless be aware of their existence should they develop new programs with an information sharing dimension.

In 2020, GAC initiated a full review of the Avoiding Mistreatment Compliance Committee (AMCC) as directed by its terms of reference. GAC has advised that notional recommendations have been developed to address the identified shortcomings. Recommendations include timeliness of Committee decisions, addressing duty of care issues, and reporting case outcomes regarding Committee decisions.

NSIRA has been advised that the AMCC’s secretariat review will be completed in 2022 and the terms of reference will be updated shortly after. In response to NSIRA’s inquires about risk analysis, GAC has advised that during the review period they created a new risk assessment form and are developing a broader orientation guide with the goal of supporting employees through the risk assessment and decision-making process. These issues are further explored in section two of this report.

RCMP has noted internal shortcomings in regards to country assessments and the inability to regularly update the reports. A framework has been provided to NSIRA on how the RCMP intends to remedy these shortcomings in the future to better serve the Foreign Information Risk Advisory Committee (FIRAC) process.

Reporting

Subsection 7(1) of the Act requires deputy heads to submit a report to the appropriate Minister on the implementation of directions received under the Orders in Council during the previous year. The ACA stipulates that report submissions are required before March 01 of each year.

All twelve departments have fulfilled their obligations to report to their respective ministers The Communications Security Establishment (CSE), and TC did, however, submit their reports shortly after the March 01 deadline.

Subsection 7(2) of the Act also requires deputy heads make an unclassified version of the report available to the public as soon as feasible after submission to the Minister. Reports were made available in all of the twelve departments.

Section 8 of the Act requires the Minister to provide a copy of the report to the National Security and Intelligence Committee of Parliamentarians (NSICoP), NSIRA and, if applicable, the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police (CRCC).

The table below captures a summary of both the departmental responses to the implementation questions and NSIRA’s assessment regarding these responses. The assessment was based on the associated details provided by departments in the context of the specific information requested. If a specific requirement was not met, it has been flagged. The relatively few instances of these were connected with departments not meeting certain reporting obligations under the Act.

Summary Table 1.1 – Requirements under the Act
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
Cases referred to the deputy head? No No No No No No No No No No No No
Was a report submitted to the Minister? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Was the report made available to the public? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes
Did the Minister provide a copy to NSICoP, NSIRA, CRCC? Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes Yes

Case Triage and Escalation

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

All twelve departments indicated that they did not have any cases referred to the Deputy Head level for determination. This is a requirement of the OiC in cases where officials are unable to determine if the substantial risk can be mitigated. Therefore, all additional reporting requirements associated with this level of decision were not applicable.

Summary Table 1.2 – Cases Escalated, by Level of Approval
  CBSA CRA CSE CSIS DFO DND FINTRAC GAC IRCC PS RCMP TC
First Level. (Supervisor/Deputy Chief) 0 634 236 (23) 780) 0 Not Known/Not Tracked 48 6 2 401 55 0
Second Level (Manager/Chief) 0 325 176 (24) 243 0 Not Known/Not Tracked 48 6 2 401 55 0
Third Level(Director/DDG) 8(25) 69
Fourth Level (DG/Committee/ Working Group) 0 63 1 (26) 81 0 7 48 0 0 0 55 0
Fifth Level (ADM/A.Commis sioner/L1) 0 0 0 (27) 0 0 2 0 0 0 0 55 0
Sixth Level (Deputy Head) 0 0 0 0 0 0 0 0 0 0 0 0

NSIRA notes that this is the third consecutive year where there have been no cases referred to the deputy head level in any department.

Future reviews may be particularly attuned to the issue of case escalation and departmental processes for decision-making, as one of the stated objectives of NSIRA’s review of ACA obligations is to ensure that the assessment of risk is escalated to appropriate level of authority.

Implementation of Previous Recommendations

As part of this review, NSIRA requested information regarding the implementation of previous recommendations. The following analysis is based on responses received from departments.

In the 2019 NSIRA Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities (2019-06), NSIRA recommended that “the definition of substantial risk should be codified in law or public direction.” NSIRA notes that some departments have accounted for this gap by relying on the definition of substantial risk in the 2017 MDs. In light of the pending statutorily mandated review of The National Security Act, 2017 (Bill C-59) and the centrality of the concept of substantial risk to the regime governing the ACA, NSIRA reiterates its 2019 recommendation that the definition of substantial risk be codified in law.

DND/CAF has advised NSIRA that as a result of its recommendation, the department has included the definition of “substantial risk” within the Chief of Defence Intelligence Functional Directive on DND/CAF Information Sharing Activities with Foreign Entities. However, it should be noted that DND/CAF has also adopted additional definitions including its definition of “foreseeable.” NSIRA has previously expressed its concerns in its 2019 detailed Annex of DND/CAF application of the MD regarding the DND/CAF interpretation of foreseeability. DND/CAF has also advised NSIRA that it leveraged the human rights assessment methodology from other organizations to develop the methodology for DND/CAF’s profiles. DND/CAF has also advised that it is actively participating with ACA-related interdepartmental working groups to share its country’s human rights methodology, procedures, and assessments, and raise concerns.

Of the twelve departments, CRA, CBSA, CSIS, DND/CAF, PS and TC have continued to adjust frameworks and policies as a result of the findings and recommendations from previous reviews of the ACA. While recommendations may not have been specific to individual departments, many have advised that they have taken into them into consideration and applied improvements more generally.

CRA for example in response to Recommendation #1 from NSIRA’s 2019 review (regarding the importance of conducting periodic internal reviews), has reviewed its exchanges of information procedures. As a result, CRA has implemented procedural changes where risk assessments deemed to be of low-risk are now approved at the manager level, whereas previously the minimum approval level was Director.

CBSA has provisionally approved its ACA policy and is currently conducting an additional review to ensure that the policy is operable across multiple program areas. CBSA has advised that the policy includes guidance on the disclosure of information, the request for information, and the use of information where there may be a substantial risk of mistreatment of an individual. As part of the policy, the CBSA has incorporated procedures and processes to assess risk and coordinate with its Senior Management Risk Assessment Committee.

PS has also finalized its draft policy in response to NSIRA’s 2020 ACA review finding that it did not finalize its policy frameworks in support of the Direction received under the ACA. PS has noted that a policy was approved and came into effect on January 1, 2022. NSIRA has been advised additional aspects of the policy are still being implemented, including the development of risk assessment tools.

Finally, TC has advised NSIRA that it has taken stock of feedback on the implementation of the ACA since initial promulgation of the Corporate Policy in August 2020. TC notes that its corporate policy is under revision and seeks to clarify and strengthen key elements. TC has advised that adjustments underway include refining language to further clarify roles, responsibilities program-level requirements, and timelines associated with implementation. To this end, TC is providing more guidance on reporting format and content requirements for program-level support to the annual reporting exercise.

At the program level, TC is reviewing the policy impact of changes (over the past year) to the functional structure and roles associated with the Passenger Protect Program (PPP). To date, the PPP is the only program activity that TC has identified where risks associated with the ACA may be present. The PPP is currently transitioning to an enhanced framework, which is expected to be fully implemented prior to March 2023.

NSIRA maintains its previous recommendation that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the ACA.

Royal Canadian Mounted Police

The ACA review for 2021 is NSIRA’s second full year assessment of the implementation of the Act. As discussed in the background to this review, NSIRA has complemented the knowledge gained through its annual review of the ACA with an in-depth analysis of the implementation of the Directions. The in-depth analysis highlights to departments some best practices within the Government of Canada as well as some potential issues in the adopted frameworks. This year, the RCMP and GAC were selected. As one of the “original” departments subject to the 2011 Ministerial Direction, the RCMP has had over a decade to develop, implement, and adjust its framework. GAC was selected because it was issued a Ministerial Directive in 2017 and due to its role as a primary developer of human rights reports.

Implementation of the ACA

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

In 2011, the RCMP was issued the Ministerial Direction on Information Sharing with Foreign Entities. However the issued MD only applied to information sharing in national security matters. In response to the 2011 MD, the RCMP created the Foreign Information Risk Analysis Committee (FIRAC), the Committee was renamed the Foreign Information Risk Advisory Committee following the issuance of the 2017 MD.

The 2017 MD’s scope was broadened to include all units and personnel of the RCMP, and FIRAC was expanded accordingly. The enactment of the ACA imposed the requirement of the Orders in Council directions to the Commissioner. The operational requirements between 2017 and 2019 remained the same. The RCMP’s Implementation of the ACA is composed of three key mechanisms, FIRAC, Law Enforcement Assessment Group (LEAG), and Annual Reporting.

FIRAC is an advisory body to senior management, tasked with providing RCMP personnel with a mechanism to review information exchanges where there may be a substantial risk of mistreatment. FIRAC is a central part of the determination making mechanism for cases with ACA considerations. The committee examines the operational context of each request, the application of risk-mitigation strategies, and the strength of assurances and makes recommendations to the responsible Assistant Commissioner.

It is important to note that the Terms of Reference for FIRAC were updated in December 2021, this is after the conclusion of the last FIRAC meeting on the case study discussed below. The previous Terms of Reference which were drafted following the issuance of the 2017 MD stated that “in case of information sharing where there is a clear operational need to proceed, but a substantial risk of mistreatment, the decision will be referred to the Commissioner for final approval, as per the MD and Operational policy”. The revised Terms of Reference identifies that the Assistant Commissioner, or Executive Director is responsible for deciding whether the substantial risk of mistreatment can be mitigated. The Terms of Reference now clearly stipulates that the Assistant Commissioner, or the Executive Director as the sole decision maker, and that FIRAC fulfills an advisory function. NSIRA cautions that this apparent or perceived delegation of the final decision to the Assistant Commissioner risks non-compliance with the purpose and object of the Act and the OiC.

The Committee is comprised of two rotating chairs and a number of members from various divisions within the RCMP. As a result of an internal review, the RCMP have adjusted membership of FIRAC to ensure that co-chairs were not making determinations on cases from their respective units, with the intention of removing situations where a real or apparent conflict of interest could arise.

FIRAC meets bi-monthly or on an as-needed basis when urgent, time sensitive cases arise. All recommendations made by the committee are non-binding. NSIRA has also observed that the addition of Committee members is planned for April 2022.

Over the last year, the RCMP have made efforts to improve their framework and have created tools to aid personnel in engaging with FIRAC. They have established a FIRAC Coordination Unit, which is responsible for conducting consultations with personnel in order to help triage potential cases and determine the appropriate level of FIRAC engagement. The RCMP have also developed a suite of tools outlining definitions and thresholds, mitigation strategies and FIRAC requirements.

The FIRAC Coordination Unit works with RCMP staff, and members to assist with the risk assessment process and determine if a FIRAC evaluation is required. The Coordination Unit’s roles and responsibilities have been adjusted with the stated goal of providing guidance and support to members to strengthen case submissions. The intent of the Unit is to improve upon record keeping, identify internal strategic level issues, engage with external federal partners on cross-cutting issues to enhance processes and practices, and to share outcomes of case-specific FIRAC meetings with LEAG to inform updates on foreign entity assessments.

The RCMP is also in the final stages of updating its operational manual with the goal of supporting the Direction’s consistent application across the RCMP. This update is intended to clarify roles and responsibilities, as well as thresholds and triggers that require an information exchange to be reviewed by FIRAC.

As will be addressed later in this report, the 2019 OiC includes a requirement for the case to be referred to the RCMP Commissioner for determination, where officials are unable to determine whether the risk of sharing information can be mitigated. Additionally, pursuant to section 3(1)c of the OiC, the RCMP Commissioner must report and disclose any information considered in making the determination or decision to NSIRA, the Civilian Review and Complaints Commission for the RCMP (CRCC), and the National Security and Intelligence Committee of Parliamentarians (NSICoP) in a timely manner, if certain information that was likely obtained through the mistreatment of an individual by a foreign entity was used, in order to prevent loss of life, or significant personal injury.

The LEAG is responsible for developing country assessment profiles and maintaining the Integrated Collaborative Environment portal, where the information is stored and accessed by officers as needed. NSIRA was informed that during the last few years, the LEAG team has been severely underfunded and under-resourced, resulting in country profiles that are out of date with a third of countries having no assessment report whatsoever.

An annual report detailing the implementation of the Act and any cases brought to the Commissioner for determination must be sent to the Minister of Public Safety, NSIRA, NSICoP and the CRCC. The RCMP must also disclose any information considered in the making of a determination or decision. For full description of the RCMP’s process please see Annex A: Departmental Frameworks.

The RCMP continues to improve upon FIRAC process. Recently, the RCMP has made strides to enhance products used to assess whether proposed information exchanges carry a substantial risk of mistreatment that require FIRAC assessments. These improvements include visual tools outlining the decision-making process, key definitions, mitigation strategies, and triggers for a FIRAC evaluation.

RCMP continues to make considerable progress on updating resources on the designated SharePoint site, the ACA training module, and policy in the RCMP operational manual. While these initiatives are still in progress, NSIRA commends the RCMP’s initiative in conducting an internal review of FIRAC, and making efforts to address identified shortcomings.

Information Sharing Framework and Risk Analysis

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment, is a best practice.

The RCMP’s information sharing framework as it relates to ACA is predicated on managing risk. While this is largely dependent on the use of assurances and caveats, investigators rely on the Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) assessment of the particular country or foreign entity in question. LOs/ADOs as part of their role, are expected to provide up-to-date information on current country and entity reports, relationships established with specific entities, and the RCMP’s history as it relates to information sharing and current human rights records. Investigators use this information to help inform a mitigation measure applied to a proposed information request, and/or disclosure.

In making assessments and providing recommendations to the Assistant Commissioner, FIRAC considers the specifics of the case included in the initial risk assessment (included in the FIRAC submission), the LEAG country assessment, as well as input from the Liaison Officers/Analysts Deployed Overseas (LO/ADO). A Record of Decision is completed after each meeting and highlights the history of sharing with the entities, the risks and mitigation measures discussed, and the final recommendation of the Committee. Based on the information provided in the Record of Decision and the recommendation of the committee, the Assistant Commissioner will then make a determination.

While the RCMP has not formalized a Gender Based Analysis within their ACA risk-related assessments, NSIRA notes that considerations applied in the RCMP’s country risk assessments identify vulnerable groups at risk of mistreatment under the “Human Rights Concerns for Specific Groups.” Individuals identified as at risk in a country/entity designated as medium risk would require a FIRAC assessment prior to any information exchanges.

NSIRA sampled twenty instances where FIRAC was convened. However, there were a number of cases where multiple FIRAC meetings pertained to the same case. For example, [**redacted**] which is examined in closer detail as part of the NSIRA’s sample file review, had three separate FIRAC meetings. The twenty FIRAC instances in the selected sample amount to sixteen individual cases. Requests made by NSIRA used the FIRAC nomenclature, and the RCMP fulfilled requests based on what was requested in the Requests for Information. The result was that NSIRA was only able to view case file information where the case was a touch point within the FIRAC process; the full operational case files were not provided.

NSIRA recognizes that the RCMP fulfilled its obligation when responding to our request for information. However, when it became clear that NSIRA had not obtained the entirety of the case, including the investigative file, significant time constraints prevented NSIRA from obtaining and considering the additional information in this review.

Outbound Information Sharing

NSIRA observed that in at least 35 percent of FIRAC cases sampled, the RCMP factored the potential for the negative impact of not sharing in their assessment. FIRAC’s assessment considers the risk of not sharing outbound information with a particular emphasis on maintaining, developing, or preserving a relationship with an information-sharing partner. Furthermore, the RCMP informed NSIRA that they will also consider the potential public risk to security of not sharing the information. NSIRA understands that the reliability of assurances and caveats depend crucially on the circumstances and the context of a particular case, but would strongly encourage the RCMP to base its rationale for sharing information primarily on the risk to the individual. NSIRA notes that the risk assessment and mitigating strategies (to minimize risk) are the primary tools to be used when assessing whether information is to be shared. The ACA and issued Orders in Council do not permit the weighing of external considerations such as relationship damage associated with not sharing information and public safety against the risk to the individual.

Mitigation and Assurance Measures

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

The RCMP advised NSIRA that any assurances or caveats that have or have not been adhered to in relation to information sharing with foreign entities are recorded within the investigative case file. The RCMP further explained that information is shared on a case-by- case basis by means of either the Liaison Officer responsible, or INTERPOL channels.

Liaison Officers/Analysts Deployed Overseas (LOs/ADOs) are required to record their interaction in their notes which would be included within the operational investigative file. The RCMP has advised NSIRA these notes are where any violations of assurances or caveats would be recorded.

The RCMP explained that it relies on its overseas network to monitor the reliability of assurances and caveats, and that personnel meet regularly with law enforcement partners and foreign allied LOs. The RCMP further noted any indication of a deterioration in human rights within a country or specific report on mistreatment of an individual would be discussed and captured within the RCMP (operational) case file, and ultimately documented in the RCMP’s FIRAC risk assessment form.

As noted above, due to time constraints, NSIRA obtained information on FIRAC meetings and the supporting documents, and did not have an opportunity to review the RCMP’s operational case files. When NSIRA asked to provide rationales used to assess the reliability of assurances and caveats for the selected sample, NSIRA was referred back to the FIRAC risk assessment form (also known as Form 6517), and provided with the following:

The footnote highlights a number of case files. General and Supplementary reports on these files were reviewed in the preparation of this response. No concerns with respect to assurances were documented and only one instance with respect to caveats was identified. In this regard, [**redacted**] documents one instance wherein a partner agency had not adhered to a caveat’s requirement to coordinate actions – no allegation of mistreatment was documented on the file. The issue was raised with the partner agency and addressed.

NSIRA notes that while the [**redacted**] was in relation to a company operating in the [**redacted**], witness information was sought from the [**redacted**]. The LEAG Country Risk Assessment for [**redacted**], designated as medium risk, does cite an issue specific to the sharing of information and the use of caveats, but has not been updated since August 2018. The RCMP has advised that:

While the LEAG country assessment has not yet been updated, the LO would be expected to raise this issue in any future consultations with various investigative teams seeking to share with this entity.

NSIRA stresses the importance of the post-monitoring of assurances and caveats. NSIRA has observed that the issuance of an assurance, and/or caveat may sometimes rely on assurances provided by a specific official (within the foreign entity/country). Absent appropriate documentation, this may be problematic due to the fact that movement within positions is to be expected and assurances can no longer be valid if the individual has moved out of the position. Assurances must be followed up on and renewed to ensure they are being followed in the event of employee turnover.

Furthermore, there is no centralized process for the documentation of assurances. Rather, some documentation that is occasionally noted on specific investigative files may be problematic in situations where LOs/ADOs are rotational. If the investigative file is closed, the new LOs/ADOs to the post may not be aware of situations where assurances have not been respected.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Country and Entity Profiles

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

In 2019, the RCMP conducted an internal review of its information sharing framework including LEAG and FIRAC. Based on this review, NSIRA recommended in 2019, that departments adopt internal reviews of their policies and processes as a best practice. While it is not the intention to cover items already identified in the (internal) review, NSIRA notes that three years have elapsed and the issues associated to country and entity assessments still remain.

Of the 90 assessments, the RCMP is currently using to base its risk assessments, 87 percent have not been updated since 2018, and the remaining thirteen percent have not been updated since 2019. Over the course of 2021, the RCMP did not update any of its country profiles. NSIRA has been advised that in 2022, [**redacted**] but cite funding constraints as a key challenge.

A key finding of the RCMP’s internal review relates composition of the profiles themselves, in that they: “do not sufficiently reflect the RCMP’s operational experience.” The review states that: “LEAG country and entity risk profiles are predominately based on open source information rather than input from operational units…” The RCMP through the course of the review emphasized the role and importance to the Liaison Officer during the FIRAC process, suggesting that the Liaison Officer is positioned to offset any shortcoming with the country and entity profiles. NSIRA notes the internal review highlights some of the challenges faced by the Liaison Officers, referring to the added responsibilities of the LEAG and the FIRAC processes as adversely affecting their ability to preform their regular duties.

NSIRA notes the RCMP’s ongoing efforts at improving its post-monitoring efforts. NSIRA looks forward to reviewing the progress made over the next year on the measures taken on updating the RCMP’s country profiles, and inclusion of post-monitoring of automating media monitoring and information sharing tracking mechanism with INTERPOL Ottawa.

Case Study: [**redacted**]

[**redacted**] the RCMP sought approval to interview a [**redacted**]

[**redacted**] The RCMP sought to [**redacted**] interview [**redacted**] in order to assess the current risk or threat [**redacted**] to Canada and Canadian citizens, [**redacted**]. The RCMP has advised that a “…successful interview could advance the investigation [**redacted**]and significantly improve the ability to identify the threat and risk [**redacted**] to [**redacted**] security.”

Additionally, the RCMP believed that “engagement with [**redacted**] may lead to [**redacted**] information and evidence [**redacted**].

[**redacted**]

The RCMP’s internal Country profile classifies [**redacted**] as a High-Risk Profile (RED). The profile notes serious documented allegations of human rights abuses [**redacted**] (but not limited to) torture [**redacted**] suspects routinely subjected to unfair trials. The RCMP had concerns that “If [**redacted**] could face torture and mistreatment [**redacted**]”. As per policy the case was escalated to the Foreign Information Risk Advisory Committee (FIRAC).

a) FIRAC [**redacted**]

[**redacted**], the FIRAC convened and discussed the request to interview [**redacted**] Committee found that there are substantial risks of mistreatment for [**redacted**] that there are currently no measures in place that could effectively mitigate the identified risks. FIRAC noted [**redacted**].

FIRAC did however also note, “that efforts should be made to better position possible future interviews.” They noted that [**redacted**] would “allow the RCMP to monitor the outcomes and assurances of discussions at a strategic level [**redacted**].

Accordingly, FIRAC recommended that the RCMP “engage in discussion [**redacted**] on the [**redacted**] potential for [**redacted**]. The Assistant Commissioner for [**redacted**] approved this recommendation.

Events of [**redacted**]

In response to the FIRAC recommendation, senior RCMP [**redacted**]

[**redacted**]

Based on [**redacted**] the investigative team sought FIRAC’s recommendation to allow [**redacted**] further discussions [**redacted**] in order to have the RCMP [**redacted**] interview with [**redacted**] and seek assurances [**redacted**].

[**redacted**]

[**redacted**], the FIRAC convened [**redacted**] to consider the request to engage and exchange information to [**redacted**] interview [**redacted**] to seek assurances [**redacted**]. The request was approved by FIRAC, if certain mitigation measures and assurances be received, [**redacted**].

Events of [**redacted**]

[**redacted**] RCMP [**redacted**] engaged the [**redacted**]. The RCMP [**redacted**] there is a [**redacted**] they would be interested in interviewing [**redacted**].

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

[**redacted**]

The RCMP [**redacted**] escalated the requests to interview [**redacted**] to FIRAC with additional mitigation measures.

[**redacted**]

[**redacted**]

FIRAC convened a meeting to discuss the request to share the personal information of [**redacted**].

The Committee concluded that there is a substantial risk of mistreatment [**redacted**] should the information be shared and that said risk cannot be mitigated by caveats and assurances. Accordingly, the Committee recommended that the information not be exchanged. This recommendation was based on the following concerns:

  • [**redacted**]
  • The existence of a significant risk of mistreatment that could not be mitigated [**redacted**].
  • Inability to guarantee [**redacted**]
  • Safety concerns based on information that may be derived from the interview;
  • [**redacted**]
  • [**redacted**]
  • Assurances were deemed insufficient to mitigate the risk, [**redacted**] to allow for an assessment of the confidence in the assurance.

FIRAC recommended [**redacted**] explore additional options to reduce the potential risk of mistreatment and then return to the committee for reconsideration. Among these options, the Committee suggested [**redacted**].

[**redacted**], the Assistant Commissioner [**redacted**] rejected FIRAC’s recommendation and allowed the sharing of information. He based his decision on the following:

  1. [**redacted**] the RCMP should consider the consequences of not sharing [**redacted**] as this would be detrimental for the relationship stating that “engagement [**redacted**] will give insight and influence”;
  2. [**redacted**]
  3. The importance of the RCMP maintaining a strong relationship [**redacted**].

The Assistant Commissioner then concludes, “failure to share presents risk that cannot be managed [**redacted**]. Although influence is not guaranteed, I believe it is the better choice”

A subsequent email by the Assistant Commissioner [**redacted**] outlined additional considerations that factored into the decision to reject FIRAC’s recommendations. These considerations focused on the risk of not sharing the information. The additional information included operational and strategic considerations [**redacted**]. The Assistant Commissioner stated that lack of engagement [**redacted**]. Strategically, the Assistant Commissioner noted the risk to relationship should the information not be shared, noting that “failure to follow through [**redacted**] and associated mitigation efforts articulated below will likely have a negative impact on the [**redacted**] relationship [**redacted**].

The Assistant Commissioner’s reasoning goes on to include a “necessity” analysis regarding the challenges [**redacted**] the importance of the information from the interview, and the importance of the relationship [**redacted**]. Of note, the Assistant Commissioner notes that [**redacted**] a strong relationship [**redacted**] will aid in plans to mitigate the greater risk while also managing the risk that exists today for the Canadian [**redacted**]. The Assistant Commissioner also concludes his email by stressing that it is his belief that sharing the information is required to reduce the risk of mistreatment [**redacted**] that lack of involvement will lead to greater risk.

Analysis

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated.”

The ACA and issued OIC place an absolute prohibition on the sharing of information where there is a substantial risk of mistreatment of an individual. Unless “officials determine that the risk can be mitigated, such as through the use of caveats or assurances and appropriate measures are taken to mitigate the risk”, the information cannot be disclosed. Section 1(2) of the OICs further stipulate, “that where officials are unable to determine whether the risk can be mitigated, the Commissioner must ensure that the matter is referred to the Commissioner for determination.

The Assistant Commissioner’s decision to share the information contrary to FIRAC’s recommendation, cites section 1(2) of the OIC and concludes that since the FIRAC is responsible for making a recommendation to the Assistant Commissioner then the Assistant Commissioner is the final decision maker. The Assistant Commissioner “made the decision that the risk can be mitigated.” The Assistant Commissioner did not consider that making the final decision in this instance ran contrary to the process set out in the FIRAC Terms of Reference, and contrary to the OICs. The OICs are clear, where officials are unable to determine whether the risk can be mitigated the matter must be referred to the Commissioner…” Accordingly, pursuant to section 1(2) of the OIC, NSIRA notes that this case should have been elevated to the Commissioner for determination.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

[**redacted**]

A number of assumptions characterize the justifications by the Assistant Commissioner to share the requested information.

[**redacted**]. However, this reasoning disregards [**redacted**]. It further dismisses the RCMP’s own reporting [**redacted**]. FIRAC’s record of decision which notes, [**redacted**]. The Assistant Commissioner accordingly disregards the possibility that [**redacted**].

In the alternative, the Assistant Commissioner relies on [**redacted**] but does not consider now the risk [**redacted**] may increase [**redacted**].

Secondly, the Assistant Commissioner’s reasoning relied on [**redacted**].

The Assistant Commissioner does not address FIRAC’s concerns for [**redacted**] the insufficiency of mitigation measures. Rather the Assistant Commissioner concludes [**redacted**] greater risk should the information not be shared – but does not explain why or how so? Nor does the Assistant Commissioner address FIRAC’s concerns regarding [**redacted**].

Additionally, the Assistant Commissioner’s decision considered and emphasized the importance of the relationship between the RCMP [**redacted**] While FIRAC expressed concern assurances would be respected. The Assistant Commissioner’s reasoning focuses on the importance of [**redacted**], that relationship [**redacted**].

As mentioned earlier, according to the RCMP:

“…while the ACA and OiC may not speak to external considerations, it does not prohibit strategic considerations as part of the totality of the analysis, rather than against the risk to the individual, including whether strategic partnerships may act as a mitigation measure. It is important to note that the ACA and OiC do not supersede our obligations under the RCMP Act.”

The RCMP further noted that: “…As such, any action or inaction could result in unwanted consequences, and to include them as a consideration to demonstrate due diligence, and that all aspects of an activity is considered is prudent. Strategic relationships, or more importantly, in this case, actions that jeopardize the strategic relationship, can lead to harm. The A/C clearly stated that.”

NSIRA notes that the assessment of mistreatment must be limited to whether the disclosure would result in a substantial risk of mistreatment to the individual and whether said risk may be mitigated. NSIRA strongly cautions against the use of additional considerations such as strategic relationships in the assessment of substantial risk.

It should be noted that the Assistant Commissioner did provide additional mitigation measures for consideration. However, those measures were all premised on [**redacted**]. The measures did not require that the assurances and the FIRAC suggested mitigation measures be adopted as a prerequisite to the information sharing.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Finally, in the case at hand the Assistant Commissioner responsible for approving the FIRAC recommendations was the same Assistant Commissioner supervising the business line of the case. In 2019 NSIRA recommended that “departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested in the outcome.” As discussed in paragraph 61 above, in 2021 the RCMP adjusted its FIRAC process such that there are co-chairs for the FIRAC. Adding an additional Chair (co-chairs) was to ensure that the Chair overseeing a specific FIRAC is not the one responsible for business line where the case originated. The case at hand demonstrates the need to emulate that structure at the senior level in order to maintain independent decision-making and ensure that the case focus is on the substantial risk of mistreatment to the individual rather than additional strategic considerations.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Global Affairs Canada

During the course of the review period from January 1, 2021, to December 31, 2021, six cases reported to having been referred to the Intelligence Policy and Programs Division (INPL) for further assessment. In the cases that were provided to NSIRA all were specific to Mission security, where Missions were dependent on local authorities to assist in situations where there was a potential threat to staff at the embassy or consulate. When asked about the low number of cases, GAC advised NSIRA that sharing personal identifying information with foreign entities was very rare in an ACA context.

Implementation of the ACA

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

On December 14, 2017, GAC was issued Ministerial Direction on Avoiding Complicity in Mistreatment by Foreign Entities (2017 MD). GAC had not received the Ministerial Direction on Information Sharing with Foreign entities (the 2011 MD) that was issued to a number of other departments.

The department manages a global network of over 175 missions in 110 countries, employing approximately 12,000 staff with an operating with a budget of over $7 billion.

When asked how the department operationalizes the Act, GAC referred to their outreach and training programs. GAC advised NSIRA that their training programs targeted specific staff to ensure awareness of and compliance with the ACA. The training outlines the roles and responsibilities regarding the ACA and Orders in Council requirements, and provides employees a definition of “substantial risk,” and points of contact at headquarters.

In 2021, NSIRA committed to further scrutinizing the processes regarding ACA triage and decision-making by reviewing both GAC and the RCMP. In the 2020 ACA review, NSIRA found that there were significant divergences in the evaluation of risk and required level of approvals across departments. In particular, NSIRA identified procedural gaps in GAC’s risk assessments that should have warranted escalation to the Deputy Minister.

When asked if GAC had initiated any adjustments, or changes to frameworks or policies as a result of the findings and recommendations from previous reviews of the ACA, GAC advised that adjustments had been made to the framework by creating a Mistreatment Risk Assessment form. They explained that the form would support the application of a more consistent threshold for elevating a case in the decision-making process, and would standardize how cases are documented. As of August 31, 2022, GAC has yet to implement the use of this form.

Currently, the Head of Mission (HoM, or Chargé) makes the initial assessment in determining if the risk of mistreatment to the individual may be mitigated below the substantial risk threshold. Only where the HoM identifies a concern as to the sufficiency of the mitigation measures or assessment, would the HoM seek guidance through the Intelligence Policy and Programs Division (INPL) generic e-mail.

INPL can assist the Mission in conducting a risk assessment. If at this point it is determined there is a substantial risk of mistreatment that cannot be mitigated and the Mission still wants to proceed, the responsible geographic Director General may request that the Avoiding Mistreatment Compliance Committee (AMCC) be convened. The AMCC provides a decision to the HoM. GAC has advised that the role of the AMCC:

….is to recommend risk-mitigation strategies, seek escalatory senior-level discussion and approval for decisions as required, up to and including the Deputy Minister of Foreign Affairs, and document how each case is managed. It is convened on an ad hoc basis to review the proposed disclosure, request, or use of information in cases in which prohibitions under the Directions may be engaged. The Committee is similar to structures that exist within other departments and agencies subject to the OiC.

In 2020 and 2021, GAC initiated a review of the Secretariat of the AMCC, formerly known as the Ministerial Direction Compliance Committee (MDCC). GAC has advised that notional recommendations have been developed to improve the working methods of the Committee and update the terms of reference. Explaining that the timeliness of Committee decisions, addressing duty of care issues, and final reporting of case outcomes regarding Committee decisions are currently being examined. It is expected that the AMCC Secretariat’s review will be completed in 2022 and the terms of reference updated shortly thereafter.

In the six cases provided over the review period, NSIRA observed that the final decision on whether to share information with local authorities was left to the HoM. This is best illustrated in the HANOI case where the mission was advised

To note, decision-making authority on such situations ultimately rests with mission/geo. INPL’s role—as departmental focal point for the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA)—is simply to advise on relevant considerations, not authorize.

In further correspondence between INPL and the Mission in Hanoi there appears to be the need for additional clarification on the decision-making roles in regards to applying the ACA. INPL further advised the Mission that “it is in fact the Mission’s responsibility to determine if there is a substantial risk of mistreatment or not.

The centralization of accountability with the HoM as opposed to headquarters represents a significant change in implementation since NSIRA’s in-depth review of GAC in 2019. Namely, in the previous review any cases where there was a potential substantial risk of mistreatment would require escalation MDCC (via the INPL) where the Committee would ultimately be responsible for deterring if the proposed mitigation measures are sufficient and if the information sharing should take place. This change in implementation threatens the independence of the process from individuals with a potential operational interest in the outcome of the information sharing.

Recommendation 5: NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Information Sharing Framework

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

GAC does not have any information-sharing arrangements with foreign entities related to the ACA. When asked in last year’s review how GAC monitors its information exchanges, the response provided reads as follows:

There is a handful of divisions at GAC that receive information that may have been obtained through mistreatment. Because of the very different type of information they each receive due to their specific mandates, each has a different process/framework for identifying information likely to have been obtained through the mistreatment. Therefore, there is not one unified set of processes at GAC for initially marking/identifying incoming information potentially derived from mistreatment.

GAC has also not conducted an internal mapping exercise to determine which business lines are subject to the ACA. Considering the low number of cases this year and the size of GAC, and that ACA training is not mandatory for staff, NSIRA has concerns that not all areas involved in information sharing within GAC are being properly informed of their ACA obligations.

When asked to elaborate on the nature of information exchanges triggering the ACA, GAC further clarified:

[T]hat information exchanges occur without formal arrangement with foreign entities, and the vast majority of the information that is exchanged does not pertain to individuals. Each information exchange situation is unique and occurs within a specific relational and country context.

Each instance of information sharing is handled on a case-by-case basis and escalated to the appropriate level based on the individual circumstances.

It is important to note that if the assessment determines that there is NOT a substantial risk of mistreatment, but that the exchange of information directly or indirectly involves personally identifiable information about an individual AND the country or foreign entities is not a trusted partner when it comes to human rights, GAC employees must still capture via a risk assessment form the reason why there is NOT a substantial risk of mistreatment and keep a thorough record.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

When determining whether there is a risk of mistreatment, GAC employees will leverage human rights reports, as well as any intelligence relevant to the country/entity associated with the information. The risk profile of the individual about whom information is shared is also taken into consideration when making a determination regarding whether a substantial risk of mistreatment exists. It is a collection of information that informs any assessment and respective decision, rather than a single tool.

Training is only mandatory for employees working in a high-risk mission or functions and offered as a suggestion for other staff at mission and headquarters. GAC has committed to establishing a dedicated ACA page on the intranet, along with supporting communication, however, employees are only encouraged to review it.

GAC provides an outreach program and training, for staff both at headquarters and at missions abroad on their ACA obligations. The ACA components are embedded in GAC’s Governance, Accreditation, Technical Security and Espionage (GATE) awareness program, the Legal and Policy Framework on Information Sharing, and a module in the Heads of Mission pre-posting training. These training courses outline the roles and responsibilities of officials regarding their ACA and Orders in Council obligations, including the definition of “substantial risk”, and key points of contact at headquarters. It is important to note that the GATE awareness program and that the ACA segment of the training is considered as an outreach tool and not a core training module, meant to provide situational awareness for Canadian- based staff on information security and intelligence topics. The training provided by the Department of Justice acts as the core training module for staff.

When asked about Consular Operations bureau training, GAC appeared to have only a cursory knowledge citing that they were aware from the 2021 Annual Report (on the Application of the Orders in Council Directions for Avoiding Complicity in Mistreatment by Foreign Entities) that ACA directions were included as part of the training session offered by the Consular Operations bureau.

The target employees for training at headquarters are outgoing Mission Security Officers, Management Consular Officers, Readiness Program Managers, Global Security Reporting Program Officers and Heads of Mission, as well as all members of the Intelligence Bureau. At mission, the training is provided to all Canada-based staff, including other government departments’ employees posted at missions. GAC has only recently begun tracking the number of staff that have been provided ACA training, and estimates that at least 300 GAC employees have been provided ACA-related training since 2020.

When further queried about the breakdowns of training provided, GAC posited that there are only a small proportion of GAC officers abroad that may encounter ACA-related decisions. With training only mandatory for some staff, NSIRA is concerned that given the volume of information exchanges, and the multiplicity of business lines there is very well potential that information sharing may be occurring, or not properly triggered by those without proper ACA knowledge.

In light of the fact that GAC engages with foreign entities with poor human rights records and operates in highly volatile environments, NSIRA expresses deep concern that GAC has not demonstrated that it has implemented ACA framework across business lines.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Human Rights Reporting

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

GAC develops classified human rights reports making them available to a number of internal Government of Canada partners. These reports are intended to provide an overview of the human rights situation of a particular country. They help inform Canada’s international engagement and programming decisions, including foreign policy, development, trade, security, and consular activities. Updated human rights reports (post 2019) include a designated section that addresses the Orders in Council and the ACA, and the circumstances of mistreatment within that country.

The coming into force of the ACA and the issuance of the Orders in Council resulted in a greater number of departments being subject to directions specific to the avoidance of mistreatment by foreign entities. Many of these departments did not have frameworks or any country assessments to support this obligation. This created an increased demand for the GAC Human Rights Reports.

Prior to Royal Assent of the ACA, GAC provided human rights reports to departments that were subject to the 2017 Ministerial Directives. GAC also works with partners to incorporate feedback on human rights reporting and considers input on countries of interest for subsequent reporting cycles. It is important to note that GAC does not keep statistics on how often, or which reports were requested/accessed by internal partners.

NSIRA recognizes that in 2021 GAC has recently implemented a prioritized list to update the human rights reports and has been making considerable headway during the review period, updating 25 percent of their profiles. A number of high-risk countries have been updated to reflect current events. Still, a number of reports are outdated and close to 60 percent of the 133 human rights reports have not been updated since 2019. For example, Pakistan, Somalia, Ukraine, and Yemen have not been updated since 2019, while South Africa and Belarus have not been reviewed since 2015.

Maintaining up-to-date reports will help ensure that critical human rights information is being used when making ACA determinations, this is especially vital considering that other department leverage GAC’s human rights report as part of their risk assessments. NSIRA notes that the Information Sharing Coordination Group coordinated by Public Safety Canada continues to work through the prioritization and the issues associated with the sharing of human rights reports across departments. It should be stressed that the GAC human rights reports are viewed as a supplement to what departments have already collected as part of their own assessments. For this reason GAC does not provide evaluative judgment on risk within their human rights reports, that is they do not designate whether a country or entity is high or low risk, consequently leaving departments to assess risk based on the information they have collected as part of their mandates.

NSIRA has been advised that the GAC country priority list was developed in consultation with partner departments and agencies, and relevant GAC divisions. And is based on an assessment of the operational needs of Canadian federal departments and agencies. While understanding the impact the pandemic had on operations, particularly at Missions abroad, NSIRA encourages GAC to develop, maintain, and continue to work with other departments and agencies to ensure countries’ HRRs are updated as regularly as possible.

Development of Human Rights Reports

GAC produces human rights reports in collaboration with its missions. Coordinated by GAC’s office of Human Rights, Freedoms and Inclusion directorate, the reports are used not only to inform risk assessments, but assist in the guidance of policy and programming decisions.

Missions are responsible for updating their human rights reports, and, if tasked, are linked to Head of Mission’s performance measurement agreements. Mission staff work collaboratively with geographic branches in the preparation of the reports. While headquarters is responsible for the tasking and coordination of the reports, it is Head of Mission that approves the report. The reports include information on the overall human rights context in the country, as well as an analysis of the significant human rights-related events that took place during the review period. Generally, reports are a collection of various sources, which include open source reporting, consultations with human rights organizations and civil society partners, and engagement with government authorities and stakeholders.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Assurances

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

GAC advised that there was no standardized approach in place to assess the reliability or document assurances received from foreign entities. Risk assessments are conducted on a case-by-case basis. When asked how assurances were developed, GAC stated that there was no statutory or regulatory language that specifically addressed the use of diplomatic assurances, but officials implicated in individual cases would consider the foreign entity’s credibility, recent precedents, the experiences of like-minded partners, and the feasibility of monitoring assurances and caveats to be communicated with the disclosure. It is the Mission’s responsibility to track and monitor whether assurances and caveats are being respected

NSIRA noted that on the ATHENS case provided by GAC, there was a concerted effort to ensure assurances and caveats were in place before information was shared with local authorities. It is in NSIRA’s opinion that the mission was attuned to their obligations under the Act (and directions) and tried to ensure the welfare of the individual detained by authorities. [**redacted**] Mission staff took remedial action to ensure that the individual is not at risk of mistreatment.

In the ATHENS case, [**redacted**]. NSIRA noted that there is no formalized tracking, or documentation mechanism for the follow-up caveats and assurances. This is problematic as mission staff are rotational and may therefore have no visibility as to their ability to rely on caveats and assurances based on past information sharing instances.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix I: Findings and Recommendations

Finding 1: NSIRA finds that the Canada Border Services Agency and Public Safety Canada still have not fully implemented an ACA framework and supporting policies and procedures are still under development.

Finding 2: NSIRA finds that from January 1, 2021, to December 31, 2021, no cases under the ACA were escalated to deputy heads in any department.

Finding 3: NSIRA finds that the RCMP has a robust framework in place for the triage of cases pertaining to the ACA.

Finding 4: NSIRA finds that the RCMP’s FIRAC risk assessments include objectives external to the requirements of the Orders in Council, such as the risk of not exchanging information.

Finding 5: NSIRA finds that the RCMP use of a two-part risk assessment, that of the country profile and that of the individual to determine if there is a substantial risk, including the particular circumstances of the individual in question within the risk assessment is a best practice.

Finding 6: NSIRA finds that the RCMP does not have a centralized system of documenting assurances and does not regularly monitor and update the assessment of the reliability of assurances.

Finding 7: NSIRA finds that the RCMP does not regularly update, or have a schedule to update its Country and Entity Assessments. In many cases these assessments are more than four years old and are heavily dependent on an aggregation of open source reporting.

Finding 8: NSIRA finds that information collected through the Liaison Officer in the course of an operation is not centrally documented such that it can inform future assessments.

Finding 9: NSIRA finds that FIRAC members concluded that the information sharing would result in a substantial risk of mistreatment that could not be mitigated. The Assistant Commissioner determined that it may be mitigated. This amounts to a disagreement between officials or a situation where “officials are unable to determine whether the risk can be mitigated”.

Finding 10: NSIRA finds that the Assistant Commissioner’s rationale for rejecting FIRAC’s advice did not adequately address concerns consistent with the provisions of the Orders in Council. In particular, NSIRA finds that the Assistant Commissioner erroneously considered the importance of the potential future strategic relationship with a foreign entity in the assessment of potential risk of mistreatment of the individual.

Finding 11: NSIRA finds that GAC is now strongly dependent on operational staff and Heads of Mission for decision-making and accountability under the ACA.

Finding 12: NSIRA finds that GAC has not demonstrated that all of its business lines are integrated into its framework under the ACA.

Finding 13: NSIRA finds that GAC has not made ACA training mandatory for all staff across relevant business lines. This could result in staff being involved in information exchanges without the proper training and knowledge of the implications of the ACA.

Finding 14: NSIRA finds that GAC has not regularly updated its Human Rights Reports. While many were updated during the 2021 review year, more than half have not been updated since 2019. This is particularly problematic when departments and agencies rely on these reports as a key source in assessing risk related to the ACA.

Finding 15: NSIRA finds that GAC does not have a standardized centralized approach for the tracking and documentation of assurances.

Recommendation 1: NSIRA recommends that the RCMP establish a centralized system to track caveats and assurances provided by foreign entities and where possible to monitor and document whether said caveats and assurances were respected.

Recommendation 2: NSIRA recommends that in cases where the RCMP Assistant Commissioner disagrees with FIRAC’s recommendation not to share the information, the case be automatically referred to the Commissioner.

Recommendation 3: NSIRA recommends that the assessment of substantial risk be limited to the provisions of the Orders in Council – namely the substantial risk of mistreatment and whether the risk may be mitigated – and external objectives such as fostering strategic relationships should not factor into this decision-making.

Recommendation 4: NSIRA recommends that FIRAC recommendations are referred to an Assistant Commissioner who is not responsible for the branch from which the case originates.

Recommendation 5 : NSIRA recommends that GAC ensure that accountability for compliance with the ACA clearly rests with the Avoiding Mistreatment Compliance Committee.

Recommendation 6: NSIRA recommends that GAC conduct a formal internal mapping exercise of other possibly implicated business lines to ensure it is meeting its obligations set out in the ACA.

Recommendation 7: NSIRA recommends that GAC make ACA training mandatory for all rotational staff.

Recommendation 8: NSIRA recommends that GAC ensure countries’ Human Rights Reports are updated more regularly to ensure evolving human rights related issues are captured.

Recommendation 9: NSIRA recommends that GAC establish a centralized system to track caveats and assurances provided by foreign entities and document any instances of non-compliance for use in future risk assessments.

Appendix II: ACA Framework and Background

It is important to note how the legal frameworks have evolved over the past decade. In international law Canada is a state party to a number of international instruments including the International Covenant on Civil and Political Rights (ICCPR), and the Convention Against Torture and Other Cruel, Inhumane or Degrading Treatment or Punishment (CAT). Many of the prohibitions on mistreatment, in these conventions are now considered customary international law. These international commitments have been implemented in Canadian domestic law; most notably the prohibition on torture is clearly defined and codified in the Criminal Code under section 269.1.

In 2010, the Canadian Government implemented a general framework for “Addressing the Risks of Mistreatment in Information Sharing with Foreign Entities”. This was the first multidepartment instruction given by the government regarding the issue of information sharing and mistreatment.

The framework was followed by two detailed Ministerial Directions to departments in 2011 and 2017. The 2017 MD was issued to seven departments and created prohibitions on the sharing of information that may lead to a substantial risk of mistreatment that cannot be mitigated. The MD also provided clear parameters on the use of information potentially derived from mistreatment. Additionally, the MD broadened the scope of applicability to all information sharing with foreign entities and not just that pertaining to national security issues.

On July 12, 2019, the Avoiding Complicity in Mistreatment by Foreign Entities Act came into force. The Act codifies and enshrines Canada’s commitment to respect the Charter of Rights and Freedoms, and the international agreements prohibiting torture and other cruel, inhuman or degrading treatment or punishment that it is party to. A primary objective of enshrining these principles through statute rather than the previous use of Ministerial Directions was to ensure that Canada’s commitment to these principles does not rest with the Minister or Government in power. The ACA provides the statutory authority for the Governor in Council (GiC) to issue directions through Orders in Council. The Act imposes an obligation on the GiC to issue Orders in Council to at least seven specific departments. In September 2019, there were in total 12 Orders in Council issued to departments and agencies engaged in information sharing with foreign entities.

The Orders in Council prohibits the disclosure of information to any foreign entity where said disclosure would result in a substantial risk of mistreatment of an individual and prohibits the making of any requests to any foreign agency for information that would result in a substantial risk of mistreatment of any individual. Additionally, the issued Orders in Council places parameters on the use of information likely derived from mistreatment of an individual by barring its use where it may create a substantial risk of further mistreatment, as evidence in any judicial, administrative or other proceeding, or in any way that deprives someone of their rights and freedoms (unless determined by the deputy head that it is necessary to prevent loss of life or significant personal injury).

Ministerial Direction (2011)

  • Issued to CSIS, CSE, CBSA and RCMP;
  • DND developed similar internal instruction; but was not issued as a ministerial direction (functional directive); and,
  • Main criticism was that departments were permitted to weigh the value of the information against the risk of mistreatment

Ministerial Direction (2017)

  • Addition of GAC, and DND (to CSIS, CSE, RCMP, CBSA);
  • A number of changes, most significant were prohibitions of the disclosure and requesting of information, as well as new limits on the use of information (derived from mistreatment);
  • Requirement for departments to maintain policies and procedures to assess risks; and,
  • Inter-agency co-operation requirement

OiCs issued pursuant to the Avoiding Complicity in Mistreatment by Foreign Entities Act (2019)

  • Issued to twelve departments, six of which had never before received formal direction regarding information sharing with foreign entities (PS, FINTRAC, TC, IRCC, CRA and DFO); and,
  • Codified many provisions of the 2017 MD

As noted in the introduction, the legal framework governing the sharing of information with foreign entities applies to information pertaining to all individuals, regardless of whether they are detainees or not. There is currently no government-wide implementation policy for the ACA. However, the issued Orders in Council do provide guidance on the requisite threshold for information sharing and the requisite hierarchy of approval where there is uncertainty as to whether mitigation measures may sufficiently diminish the substantial risk of mistreatment. Public Safety Canada in 2018, set up an Information Sharing Coordination Group with the objective of sharing best practices between departments.

Individual departments develop their own internal framework and policies for the implementation of the ACA. Some departments that were previously subject to the MDs on Avoiding Complicity in Mistreatment by Foreign Entities had a greater opportunity to create internal processes, procedures and policies to identify when information sharing practices may create a substantial risk of mistreatment. These departments have developed structured approaches to recording assurances (verbal or written) received from the foreign entities whom they engage and possible mitigation strategies such that the threat is diffused below the substantial risk of mistreatment threshold.

Appendix III: Previous Recommendations

Past findings and recommendations
Report for Year 2018 Report for Year 2019 Report for Year 2020
Finding #1: Benefits of internal information sharing process reviews. NSIRA noted that periodic internal reviews of information sharing policies and processes supported their successful functioning in the long term. Finding #1: NSIRA found that several departments, new to the considerations of the Act, described considerable progress being made during the review period and afterwards to build out formalized frameworks to support implementation. Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.
Recommendation #1: Departments should conduct periodic internal reviews of their policies and processes for sharing information with foreign entities in order to identify gaps and areas in need of improvement. Finding #2: NSIRA found that departments conducting minimal information exchanges with foreign entities have not yet fully addressed the importance of having an official information sharing framework in place. Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.
Findings #2: Departments vary with respect to the independence of their decision-making. NSIRA examined the extent to which high-risk decision-making is removed from operational personnel who may have vested interest in the sharing. In some departments, the decision-makers have a direct operational interest in the sharing of information, creating the potential for conflict between operational imperatives and departmental obligations to respect the MD. In particular, NSIRA noted that:
  • CSE and the RCMP have the most independent processes.
  • The information sharing process implemented by GAC to date remove high-risk decision-making from “front line” personnel.
  • At CSIS and DND/CAF, decision makers typically have a direct operational interest in the sharing of information.
  • CBSA has not yet operationalized its information sharing processes.
Recommendation #1: NSIRA recommends that all departments in receipt of directions under the Act have official framework that ensure they can fully support the implementation of the directions. Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.
Recommendation #2: Departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested the outcome. Finding #3: NSIRA found that the differences and variability in departmental frameworks demonstrate a previous lack of coordination across the community and a need to identify best practices. Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.
Finding #3: Lack of standardized information sharing risk assessments. Under the 2017 MD, GAC, CSIS, CSE, and the RCMP all maintain their own sets of foreign country and/or entity profiles, while DND/CAF is currently developing its own as well. The existence of multiple different assessments is duplicative and unnecessary. It may also yield inconsistencies, as departments have at times come to quite different conclusions about foreign countries’ and entities’ human rights records and the associated risks of information sharing. Recommendation #2: NSIRA recommends that departments coordinate to identify best practices for all essential components of information sharing frameworks and that ISCG is leveraged to ensure these practices are shared where possible across the community to support the implementation of the Act.
Recommendation #3: Departments should develop:
  • Unified set of assessments of the human rights situation in foreign countries including a standardized ‘risk of mistreatment’ classification level for each country; and
  • To the extent that multiple departments deal with the same foreign entities in a given country, standardized assessments of the risk of mistreatment of sharing information with foreign entities.
Finding #4: NSIRA found that there are inconsistencies in the application of existing sharing frameworks between departments, specifically concerning information evaluation thresholds, and decisions being elevated for senior level determinations.
Finding #4: The concept of “substantial risk” of mistreatment is not defined. Like the 2017 MD, the ACMFEA and its associated direction prohibit information sharing that would result in a “substantial risk” of mistreatment, Neither the ACMFEA nor its direction include a definition of substantial risk, however, despite the centrality of this concept to the regime. A definition of substantial risk existed in both the 2011 and 2017 MD; its absence now raises concerns about its interpretation in the future. Recommendation #3: NSIRA recommends that departments establish consistent thresholds for triggers in their information sharing frameworks, including initial evaluations against the concerns of the Act, when a case is to be elevated in the decision process, and how this is documented.
Recommendation #4: The definition of “substantial risk” should be codified in law or public direction. Finding #5: NSIRA found a lack of unification and standardization in the country and entity assessments being leveraged by departments, resulting in inconsistencies in approach/stance by the community when interacting with Foreign Entities of concern related to the Act.
Recommendation #4: NSIRA recommends that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the Act.

Annex A: Departmental Frameworks

Royal Canadian Mounted Police

Following receipt of the 2017 MD, the RCMP established a new Law Enforcement Assessment Group (LEAG). LEAG has a detailed Terms of Reference that outlines its membership as well as roles and responsibilities. LEAG’s primary task is to assess foreign countries and law enforcement entities with regard to the risk of mistreatment. In its assessments, LEAG considers a number of factors, including the human rights record of the country, specific foreign entities’ engagement in human rights abuses, local law enforcement’s history of respecting caveats, as well as country-specific risks to individual safety related to political views, religion, ethnicity, sexual orientation, and so on. LEAG thus “plays an integral role in informing FIRAC’s decision on whether to share information with foreign law enforcement entities.”

At present, the RCMP has categorized 146 approved country profiles, of which 20 are high risk, 69 are medium risk, and 57 are low risk. 51 country assessments remain outstanding. LEAG currently intends to update its profiles every two years, although LEAG will update some reports more frequently based on operational requirements. To date, 40 countries have been assessed as being a high priority for periodic updates due to the volume of information sharing conducted.

Graphic of FIRAC Process

Process

If an RCMP officer identified a need and wishes to share information with a foreign entity, they must follow a set process:

The officer must first consult a specific RCMP intranet website created by LEAG. The site lists countries by colour. If the officer finds that the country in question is “green”, he or she may proceed to share the information. If the country is “red”- or “yellow” and the circumstances of the proposed sharing match any of the case-specific factors and considerations listed- then the case must be referred to FIRAC. If a FIRAC is required, the officer completes a standard form which must be approved by the relevant Criminal Operations (CROPS) Officer or other approving officer. The form includes a summary of the information to be shared, the kind of sharing (request, disclosure or use), the operational context, the risks of sharing information, the investigative value of the information, possible mitigation strategies, and- where applicable- the actual information to be disclosed or used.

Once approved, the form is sent to the Director General (DG) responsible for the relevant program at RCMP headquarters for approval. Following approval, the DG submits the form to the FIRAC secretariat.

The FIRAC secretariat compiles a briefing package that includes the officer’s form, the country profile from LEAG, and any supporting documentation submitted by the DG. The briefing package is distributed to FIRAC members ahead of the meeting.

A FIRAC meeting is convened and the request is considered along with possible mitigation strategies. While the final decision regarding FIRAC’s recommendation rests with the Chair, in the vast majority of cases the decision is unanimous. Dissenting opinions are recorded in the Record of Decision (RoD). Once FIRAC has noted its recommendation, the RoD and an accompanying briefing note are sent to the Assistant Commissioner for final determination.

In cases where FIRAC cannot determine whether a substantial risk of mistreatment can be mitigated, the responsible Assistant Commissioner will provide the RoD to the Deputy Commissioner in order to obtain the Commissioner’s decision.

Global Affairs Canada

Framework Updates

Global Affairs Canada (GAC) indicated that no changes to their framework was made during the current review period.

Annex I: Global Affairs Canada Framework

Process

Triage

There is not one unified set of processes at GAC for determining whether information being used by the department is likely to have been obtained through the mistreatment of an individual by a foreign entity. If an official determines that information that he or she has received is likely to have been obtained through the mistreatment of an individual by a foreign entity and that official still wants to use the information, they are instructed in their training to consult with their Program management at HQ. Should that manager be unable to make a determination on their own as to whether the use would comply with the Act, they will consult the relevant departmental policy group and the department’s Legal Services Unit.

Senior Management Committees

The Avoiding Mistreatment Compliance Committee (AMCC) meetings focuses on the following:

  • Has the information, the use of which is being sought, likely been derived from mistreatment?
  • What are the proposed measures to mitigate the risks? What is the likelihood of their success?
  • Consider the justifications for and proportionality of any potential involvement with the foreign state or entity that may result in mistreatment.

The AMCC Secretariat will create a record of decision and circulate it for comment by AMCC members. Once finalized, it will be kept by the Secretariat for future reporting. The AMCC Secretariat follows up with the requesting official for updates on the outcome of the situation and requests a final update from the requesting official once the situation is resolved.

Global Affairs Canada’s human rights reports provide an evidence-based overview of the human rights situation in a particular country, including significant human rights-related events, trends and developments and include a section focused on mistreatment. There are no scores for countries however, and it is up to the officials to assess the risk based on the information in the reports.

Mitigation Measures

The Legal Services Unit and/or Intelligence Policy and Programs division will provide guidance on the limitations and the prohibitions of the use of information obtained through mistreatment. They are also able to propose potential mitigation measures, such as sanitization of the information, if there is a risk of further mistreatment; of depriving someone of their rights or freedoms; or if the information could be used as evidence in any judicial, administrative or other proceeding.

Share this page
Date Modified:

Review of the Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2021

Last Updated:

Status:

Published

Review Number:

22-05

Share this page
Date Modified:

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023: Report

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023


Report

Date of Publishing:

Revisions

Pursuant to section 40 of the National Security and Intelligence Review Agency Act (NSIRA Act), NSIRA may submit a special report to the appropriate Minister on any matter related to NSIRA’s mandate. The Minister must then table the special report in Parliament within 15 sitting days.

Prior to the submission of such a report, subsection 52(1)(b) of the NSIRA Act requires NSIRA to consult with the deputy heads concerned to ensure that the special report does not contain information the disclosure of which would be injurious to national security, national defence or international relations or is information that is protected by solicitor-client privilege, the professional secrecy of advocates and notaries or litigation privilege.

This document is NSIRA’s section 40 special report. It is a revised version of the classified report provided to the Prime Minister on March 5, 2024. Revisions were made to remove injurious information. Where information could simply be removed without affecting the readability of the document, NSIRA noted the removal with three asterisks (***). Where more context was required, NSIRA revised the document to summarize the information that was removed. Those sections are marked with three asterisks at the beginning and the end of the summary, and the summary is enclosed by square brackets (see example below).

EXAMPLE: [**Revised sections are marked with three asterisks at the beginning and the end of the sentence, and the summary is enclosed by square brackets.**]

List of Acronyms

Abbreviation Expansion
CEIPP Critical Election Incident Public Protocol
CTSN Canadian Top Secret Network
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DND Department of National Defence
DM Deputy Minister
FI Foreign Interference
GAC Global Affairs Canada
HUMINT Human Intelligence
IAS Intelligence Assessment Secretariat
ISR Independent Special Rapporteur
MP Member of Parliament
NHQ National Headquarters
NSIA National Security and Intelligence Advisor
NSICOP National Security and Intelligence Committee of Parliamentarians
NSIRA National Security and Intelligence Review Agency
PCO Privy Council Office
PRC People’s Republic of China
PMO Prime Minister’s Office
PSB Protective Security Briefing
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
RRM Rapid Response Mechanism
SIGINT Signals Intelligence
SITE TF Security and Intelligence Threats to Elections Task Force
TRM Threat Reduction Measure
UFWD United Front Work Department
Abréviation Développement
AC Administration centrale
AMC Affaires mondiales Canada
BCP Bureau du Conseil privé
CPM Cabinet du premier ministre
CPSNR Comité des parlementaires sur la sécurité nationale et le renseignement
CSNR Conseiller à la sécurité nationale et au renseignement
CST Centre de la sécurité des télécommunications
DER Direction de l’évaluation du renseignement
DTFU Département du travail du Front uni
GRC Gendarmerie royale du Canada
GT MSRE Groupe de travail sur les menaces en matière de sécurité et de renseignements visant les élections
HUMINT Renseignement humain (Human Intelligence)
IE Ingérence étrangère
MDN Ministère de la Défense nationale
MRM Mesure de réduction de la menace
MRR Mécanisme de réponse rapide
OSSNR Office de surveillance des activités en matière de sécurité nationale et de renseignement
PPIEM Protocole public en cas d’incident électoral majeur
RCTS Réseau canadien Très secret
RPC République populaire de Chine
RSI Rapporteur spécial indépendant
SCRS Service canadien du renseignement de sécurité
SIGINT Renseignement électromagnétique (Signals Intelligence)
SISP Séance d’information sur la sécurité préventive
SM Sous ministre
SP Sécurité publique Canada

Executive Summary

The security and intelligence community is of the consensus view that political foreign interference is a significant threat to Canada, and that the People’s Republic of China (PRC) is a major perpetrator of this threat at all levels of government. Nonetheless, the present review of how intelligence related to PRC political foreign interference was disseminated from 2018 to 2023 (a period covering the last two federal elections) indicates that there were significant disagreements between constituent components of that community, both within and across organizations, as to whether, when, and how to share what they knew.

Underlying these disagreements and misalignments was a basic challenge for the security and intelligence community: how to address the so-called “grey zone” whereby political foreign interference may stand in close proximity to typical political or diplomatic activity. NSIRA saw evidence of this challenge across the activities under review, including in decisions about whether to disseminate information and how to characterize what was shared. The risk of characterizing legitimate political or diplomatic behaviour as a threat led some members of the intelligence community to not identify certain activities as threat activities. 

Intelligence is by its nature provisory. It does not constitute proof that the described activities took place, or took place in the manner suggested by the source(s) of the information. At the same time, the fact that it is not proof does not mean it should be withheld – by this standard, very little (if any) intelligence would ever be shared. What is required – between collection and dissemination – is an evaluation of the intelligence and a decision as to whether it should, or should not, be communicated in some way.

With respect to disseminating intelligence about foreign interference in elections, the Canadian Security Intelligence Service (CSIS) confronted a basic dilemma. On one hand, information about foreign interference in elections was a priority for the government, and CSIS had geared its collection apparatus toward investigating political foreign interference. On the other, CSIS was sensitive to the possibility that the collection and dissemination of intelligence about elections could itself be construed as a form of election interference. A basic tension held: any action – including the dissemination of intelligence – taken by CSIS prior to or during an election must not, and must not be seen to, influence that election. 

This dynamic was known within CSIS, but is not formally addressed in policy or guidelines. It was not always clear, particularly to those collecting intelligence, what the general rationale and/or policy guiding the dissemination of intelligence on political foreign interference was, let alone how that rationale/policy applied to specific decisions. Overall, the perception arose within CSIS that rules and decisions were being made, and frequently changed, absent a coherent strategy or guiding principles.

NSIRA recommends that CSIS develop a comprehensive policy and strategy specifically pertaining to all aspects of how CSIS engages – investigates, reports about, and takes action against – threats of political foreign interference. This would bring coherence across the organization. It would also signal to Government of Canada stakeholders that CSIS has carefully considered all aspects of political foreign interference, including its unique sensitivities, and is reporting and advising on those threats using rigorous standards and thresholds. 

CSIS is a member of the Security and Intelligence Threats to Elections (SITE) Task Force, along with the Communications Security Establishment (CSE), the Royal Canadian Mounted Police (RCMP), and Global Affairs Canada (GAC). One of the Task Force’s primary functions is to provide coordinated intelligence reporting to a panel of senior public servants, the Critical Election Incident Public Protocol (CEIPP) Panel, during writ periods. These two bodies were established to receive, analyze, and respond to intelligence coming from the intelligence community with respect to foreign interference in federal elections.

The orientations of the SITE Task Force and CEIPP Panel were geared toward addressing broad, systematic, and largely online interference (such as that witnessed in the 2016 US presidential election). As such, they could not adequately address so-called traditional, human-based, riding-by-riding interference. NSIRA recommends several adjustments to the SITE Task Force and CEIPP Panel, meant to ensure that the full range of threats associated with foreign interference is adequately addressed by these two entities moving forward.

Outside the election context, the intelligence community collects intelligence on PRC political foreign interference on an ongoing basis. This intelligence is shared both horizontally within the community and vertically to senior decision makers, including elected officials.

During the review period, CSIS lacked the ability to definitively track who had received and read its intelligence. This was partly a consequence of the internal tracking systems of the various recipient departments, which may not have comprehensively captured this data. In the end, however, it is incumbent on CSIS, as the originator of sensitive information, to control and document access.

The consequences of not knowing who has received what manifested in the controversy regarding intelligence related to the PRC targeting of a sitting Member of Parliament.

The media and public conversation regarding this intelligence focused on two CSIS products, one from May 2021 and the other from July 2021. In fact, neither product was the mechanism through which the Minister and Deputy Minister of Public Safety were initially meant to be informed of the PRC’s threat activities against the Member of Parliament and his family. Rather, [**prior to May 2021**] there [**was CSIS intelligence**] related to the PRC’s targeting of the Member of Parliament. CSIS sent [**this intelligence**] to named-recipient lists which included the Deputy Minister and Minister of Public Safety.

Public Safety confirmed that at least one [**redacted**] was provided to the Minister [**prior to May**] 2021, likely as part of a weekly reading package. However, the department was unable to account for [**redacted**]. This is an unacceptable state of affairs. NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received and, as appropriate, read intelligence products. 

At the same time, tracking who has received what is not a panacea. There must be interest on the part of consumers for the intelligence they receive, and an understanding as to how the intelligence can support the fulfillment of their responsibilities.

In 2021, PCO and CSIS analysts produced reports meant to serve as synthesizing overviews of PRC foreign interference activities, but which the National Security and Intelligence Advisor to the Prime Minister (NSIA) saw as recounting standard diplomatic activity. This disagreement played a role in those intelligence products not reaching the political executive, including the Prime Minister.

The gap between CSIS’s point of view and that of the NSIA is significant, because the question is so fundamental. CSIS collected, analyzed, and reported intelligence about activities that it considered to be significant threats to national security; one of the primary consumers of that reporting (and the de facto conduit of intelligence to the Prime Minister) disagreed with that assessment. Commitments to address political foreign interference are straightforward in theory, but will inevitably suffer in practice if rudimentary disagreements as to the nature of the threat persist in the community.

NSIRA recommends that regular consumers of intelligence work to enhance intelligence literacy within their departments and that, further, the security and intelligence community develop a common, working understanding of what constitutes political foreign interference. While the NSIA plays a coordinating role within the security and intelligence community, the bounds of this role are not formally delineated. As such, the extent of their influence in decisions regarding the distribution of CSIS intelligence products is unclear. NSIRA therefore recommends that the role of the NSIA, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Introduction

Authority

This review was conducted under the authority of paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act (NSIRA Act).

Scope of the Review

The scope of the review included all intelligence on People’s Republic of China (PRC) foreign interference in federal democratic institutions and processes from 2018 to 2023. The specific focus was on the flow of this intelligence within government. That is, from the collectors of intelligence to consumers of intelligence (“clients”), including senior public servants and elected officials.

The review included the following departments and agencies:

  • The Canadian Security Intelligence Service (CSIS)
  • The Communications Security Establishment (CSE)
  • The Royal Canadian Mounted Police (RCMP)
  • Global Affairs Canada (GAC)
  • Public Safety Canada (Public Safety)
  • The Privy Council Office (PCO)

These are the core members of the security and intelligence community with mandates relevant to foreign interference in Canadian democratic institutions and processes. The review also received information from Elections Canada regarding its relationship with, and the information it received from, the departments and agencies noted above.

Methodology

NSIRA gathered information through a variety of means. This included:

  • Document Review (approximately 17,000 documents);
  • Nine (9) Briefings;
  • Fourteen (14) Interviews;
  • Twenty-one (21) Requests for Information;
    • These included requests for documents as well as requests for written responses to questions.
  • Direct Access to CSIS’s operational database and corporate repository.
  • Direct access to CSE’s foreign intelligence reporting database.

The NSIRA Act grants NSIRA rights of timely access to any information in the possession or under the control of a reviewed entity (reviewee), with the exception of Cabinet confidences, and to receive from them any documents and explanations NSIRA deems necessary.

Initially, NSIRA did not request the release of Cabinet confidences, as the scope of the review did not include policy responses to foreign interference from government, focussing instead on the flow of information within government. However, in his initial public report, the Independent Special Rapporteur on Foreign Interference (ISR), the Right Honourable David Johnston, recommended that NSIRA be given access to any Cabinet confidences that were provided to him for his review. In light of this recommendation, on June 7, 2023, NSIRA wrote to the Prime Minister to request that all Cabinet confidences related to its review be released to the Review Agency, and not just those reviewed by the ISR. 

On June 13, 2023, an Order in Council authorized the release, to NSIRA, of the Cabinet confidences reviewed by the ISR. The scope and focus of NSIRA’s review differs from the ISR’s May 23, 2023 report. The ISR’s report focused specifically on intelligence related to foreign interference in the 43rd and 44th general federal elections and reported on in the media. To safeguard the integrity of its reviews and maintain its independence, NSIRA could not consider a subset of Cabinet confidences (those provided to the ISR) without reviewing all other Cabinet confidences relevant to NSIRA’s particular scope and focus. NSIRA’s broader request to the Prime Minister went unanswered. As a result, NSIRA declined to consider the subset of Cabinet confidences that were provided. Given the scope of the review, NSIRA is nonetheless confident that it received all information necessary to fully support its analysis, findings and recommendations. Pursuant to its obligations under s. 13 of the NSIRA Act, NSIRA cooperated with the National Security and Intelligence Committee of Parliamentarians (NSICOP) to avoid any unnecessary duplication of work in relation to each organization’s review of the topic of foreign interference.

Review Statements

CSIS, CSE, the RCMP, GAC, and Public Safety met NSIRA’s expectations for responsiveness during this review.  PCO only partially met NSIRA’s expectations, due to delays in responding to requests for information.

NSIRA was able to verify information for this review in a manner that met expectations.

Background

Beginning in the fall of 2022, a series of reporting by The Globe and Mail and Global News cited classified CSIS documents on PRC foreign interference into Canadian democratic institutions and processes, including the 43rd and 44th federal elections. This reporting raised concerns regarding the government’s response to the threat of foreign interference and, consequently, the integrity of Canada’s democratic institutions and processes.

On March 9, 2023, NSIRA announced that it would initiate the present review of the production and dissemination of intelligence on foreign interference with respect to the 43rd and 44th federal elections. The review’s focus was on the flow of this information within government, in order to address the fundamental question: did the security and intelligence community adequately report information to those responsible for protecting Canada’s democratic processes and institutions from threats of foreign interference? The granularity of this question – which includes comparing collected raw information to the intelligence ultimately disseminated in finished products – lent itself to NSIRA’s unique mandate and access, including direct access to CSIS’s systems and the ability to speak to intelligence officers in the field. Broader policy considerations (for example what policymakers did or did not do with the information they received) were considered out of scope, and should be addressed by other organizations reviewing activities in this area, including NSICOP and the Commission of Inquiry under the direction of the Honourable Marie-Josée Hogue. NSIRA’s question is foundational in that an effective response requires adequate information.

Political Foreign Interference

Foreign interference includes covert, clandestine or deceptive activities undertaken by foreign actors to advance their strategic, geopolitical, economic, and security interests. This can occur in any sphere of society, including the private sector, academia, the media, and the political system. The latter, political foreign interference, is a subset of foreign interference more broadly.

A prominent example of political foreign interference is the spreading and amplifying of disinformation on social media platforms, such as was perpetrated by Russia during the 2016 US presidential election. Also prevalent are “traditional” (human-based) forms of interference which consist of, among other things: cultivating relationships with political officials for the purpose of interference activities; the recruitment and coercion of individuals involved in politics (including political staff); illicit, illegal, or clandestine financial donations to politicians or political parties; and targeting diaspora communities through threats and intimidation.

According to Canada’s security and intelligence community, the largest perpetrator of foreign interference (political or otherwise) in Canada is the PRC. The PRC engages in widespread and systematic interference operations at all levels of government. These activities are generally the purview of the PRC’s United Front Work Department (UFWD), which is dedicated to shaping and influencing perceptions of, and policy toward, the PRC on a global scale, through a variety of overt and covert means. While the UFWD has been in existence for decades, it is widely recognized that its activities have accelerated following the accession of Xi Jinping to permanent leadership of the PRC, coinciding with increasing tensions between the PRC and Western nations, including Canada.

CSIS has reported about foreign interference since its inception in 1984. The CSIS Act defines “threats to the security of Canada” in section 2, including what it calls “foreign influenced activities” which are “activities that are detrimental to the interests of Canada and are clandestine or deceptive or involve a threat to any person.”

CSIS’s reporting on PRC foreign interference has been subject to public controversy in the past. Most notably, in 2010, then-CSIS Director Richard Fadden made public statements regarding PRC political foreign interference in Canada, indicating that CSIS was investigating multiple politicians whom it believed were “under the influence of a foreign government.” These comments generated significant public criticism, including from the House Committee on Public Safety and National Security, which concluded that “the allegations made by the Director of CSIS tarnished the reputation of politicians and of the Chinese-Canadian community.”  

Eventually, in [**redacted**], CSIS created dedicated desks to investigate PRC foreign interference; [**One sentence edited and one sentence deleted to remove injurious information. The sentences described the organization of CSIS investigations**]. CSIS noted to NSIRA that the volume of foreign interference activity was significant, [**redacted**].

In the following years, investigations have continued to evolve, even as the sensitivity of investigating and reporting about political foreign interference (as demonstrated by the Fadden controversy) remains acute. This tension – between pushing forward on investigations related to foreign interference and tempering such efforts to account for the sensitivities involved – permeated all of the activities examined below. Intelligence is by its nature provisory. It does not constitute proof that the described activities took place, or took place in the manner suggested by the source(s) of the information. That intelligence was “collected” does not imply, necessarily, that it ought to have been disseminated to government clients. At the same time, the fact that it is not proof does not mean it should be withheld – by this standard, very little (if any) intelligence would ever be shared. What is required – between collection and dissemination – is an evaluation of the intelligence and a decision as to whether it should, or should not, be communicated in some way. This process, and these decisions, are fundamental to the work of the security and intelligence community. They are at the heart of the present review.

Findings, Analysis, and Recommendations

This section presents the review’s findings, supporting analysis, and resulting recommendations. The section is organized into three parts, as follows:

  • Part 1 reviews CSIS’s dissemination of intelligence on PRC foreign interference in the 43rd and 44th federal elections. Assessing this flow was the principal aim of the review. NSIRA selected three cases for in-depth review. The details of these cases, along with other information reviewed by NSIRA, inform general findings related to the dissemination of intelligence on PRC political foreign interference, culminating in a broad recommendation to CSIS regarding its governance in this area. 
  • Part 2 examines the role of the Security and Intelligence Threats to Elections (SITE) Task Force and Critical Election Incident Public Protocol (CEIPP) Panel. These bodies were established to receive, analyze, and respond to intelligence provided by the intelligence community. The analysis highlights deficiencies and provides recommendations to better position these bodies to address the threat of political foreign interference.
  • Part 3 steps away from the election-specific context, to assess the broader flow of intelligence on PRC political foreign interference across the security and intelligence community between 2018 and 2023, including to senior public servants and elected officials. Particular attention is given to CSIS’s methods of dissemination, and the role of the National Security and Intelligence Advisor (NSIA) to the Prime Minister. This analysis includes an overview of the dissemination of intelligence regarding the PRC’s targeting of a Member of Parliament, and an assessment of the dissemination of two in-depth analytical intelligence products on PRC political foreign interference.

Taken collectively, these components offer insight into the overall challenges associated with how intelligence about PRC political foreign interference moved within the Government of Canada during the review period.

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

NSIRA reviewed the intelligence produced by CSIS, CSE, GAC, PCO, and the RCMP related to foreign interference in the 43rd and 44th federal elections. In three cases – one from 2019, two from 2021 – NSIRA examined how CSIS disseminated intelligence to relevant entities in the government of Canada, including the SITE Task Force and CEIPP Panel.

Case Study 1 (2019 election)

Case Study 1 involved collected intelligence on PRC foreign interference activities in support of a federal election candidate.

Intelligence associated with this case was widely disseminated, including to the SITE Task Force, the candidate’s party, Elections Canada, the Office of the Commissioner of Canada Elections, senior public servants (including the CEIPP Panel), the Minister of Public Safety, and the Prime Minister. However, in certain instances the dissemination of intelligence lacked timeliness and clarity.

For example, CSIS disseminated and then recalled a key analytical intelligence product on the case prior to the election. On October 1, 2019, CSIS released a six-page National Security Brief on PRC foreign interference activities associated with the case. The brief was disseminated to a list of named recipients, including senior public servants and representatives of the SITE Task Force. Ten days later, on October 10, CSIS recalled the product, and requested that all recipients destroy the copies that had been provided. This decision was taken by the CSIS Director, following a conversation with the NSIA. When asked by NSIRA to explain the rationale behind recalling the product, CSIS indicated that neither the Director nor the Director’s office could remember the specifics of the decision, other than that it was by request of the NSIA.

At the same time, the analysis and associated assessment included in the product were provided (though not necessarily with the same detail) in oral briefings. On September 28, CSIS (in its capacity as a member of the SITE Task Force and facilitated by PCO) briefed Secret-cleared members of the candidate’s party on the intelligence indicating PRC foreign interference. Two days later, on September 30, the CSIS Director briefed this intelligence and CSIS’s assessment to the CEIPP Panel.

The Prime Minister was not directly briefed by CSIS on intelligence regarding PRC foreign interference associated with the case until February of 2021, sixteen months following the election. Nonetheless, the Prime Minister may have indirectly been made aware of the relevant CSIS intelligence. PCO noted that a briefing by PCO to the Prime Minister’s Office (PMO) on “issues related to [Case Study 1] likely took place in late September/early October 2019”, but could not provide NSIRA any documentation to this effect. Further, there is evidence to suggest that the Prime Minister was informed of the content of CSIS’s September 28 briefing on September 29.

In December 2019, the PCO Assistant Secretary of Security and Intelligence prepared a memorandum to the NSIA recommending that the NSIA brief the Prime Minister’s Chief of Staff on CSIS’s assessment [**redacted**]. The briefing would also have raised the potential vulnerabilities in the candidate nomination process. PCO indicated that there was no record confirming that the memorandum was delivered to the NSIA (though PCO was “confident that [the NSIA] was made aware of the information it contained”) and no record that the PMO was briefed as per the memorandum’s recommendation. The NSIA and the Clerk of the Privy Council, as members of the CEIPP Panel, received the September 30, 2019, briefing. In January 2020, CSIS briefed them again on the same issue. CSIS then briefed the Minister of Public Safety on the case in March 2020.

Figure 1: Graphic of Key dates, dissemination of intelligence on Case Study 1

Figure 1. Keydates, dissemination of intelligence on Case Study 1

[**Figure has been edited to remove injurious information**]

Early intelligence reporting on foreign interference activities related to the case did not sufficiently distinguish typical political activity from threat-related foreign interference. While this distinction was largely implicit, absent a clear articulation of why CSIS believed that specific activities constituted foreign interference, consumers – particularly those familiar with the tactics of political campaigns – may not have appreciated the intended import of the intelligence provided.

Case Study 2 (2021 election)

Case Study 2 involved collected intelligence on PRC foreign interference activities [**redacted**].

Intelligence associated with Case Study 2 was disseminated to [**redacted**], the SITE Task Force, the CEIPP Panel and, shortly following the election, the Prime Minister.  

While this dissemination was timely, CSIS deviated from its most common dissemination practices by limiting the number of written Intelligence Reports. It is unclear whether there was an explicit, blanket decision to suspend all Intelligence Report production on Case Study 2 during the election period, or whether the lack of Intelligence Reports was the natural consequence of case-by-case situational factors.

CSIS considered several options for addressing/mitigating foreign interference in this case. [**redacted**]. CSIS deliberated as to whether [**redacted**] should occur before or after the election. Ultimately, the risks of [**redacted**] were considered prohibitive. CSIS noted in particular the risk that if its efforts became public, CSIS might be blamed for interfering in the democratic process [**redacted**].

[**Two sentences deleted to remove injurious information. The sentences describe the dissemination of intelligence related to PRC foreign interference activities**].

Figure 2: Graphic of Key dates, dissemination of intelligence on Case Study 2

Figure 2. Key dates, dissemination of intelligence on Case Study 2

[**Figure has been edited to remove injurious information**]

As in Case Study 1, there were also issues in terms of consumers understanding the intended significance of the intelligence provided. For example, a member of the CEIPP Panel requested clarification as to how the activities were “deceptive and clandestine” (key components of CSIS’s definition of foreign interference) [**redacted**]. [**redacted**]. CSIS further noted that the PRC [**redacted**], ignoring the general notice from GAC to all foreign diplomatic missions in Canada that direct or indirect [**involvement**] in the election was inappropriate.

The intelligence CSIS collected was provided to relevant entities – in particular the CEIPP Panel [**redacted**] – in advance of the election. Indeed, according to those familiar with the Panel’s work, [**redacted**] was considered a clear “success” in terms of the 2021 election. This perception is generally shared by CSIS, [**redacted**] informing senior public officials [**redacted**].  

Nonetheless, CSIS deviated from its most common dissemination process, at least partly as a consequence of the subject matter (political foreign interference).  Further, that CSIS could not definitively say whether an explicit decision had been made to eschew written intelligence products is itself indicative of a lack of clarity with respect to how intelligence on political foreign interference ought to be handled, particularly during elections.

Overall, Case Study 2 is most instructive not as an example of the failed or inadequate dissemination of intelligence, but as further illustration of the unique challenges associated with disseminating intelligence on political foreign interference that, when combined with other examples and cases, reveal broader, systemic issues with how CSIS communicates the information it collects about political processes.

Case Study 3 (2021 election)

Case Study 3 involved collected intelligence on PRC foreign interference across several ridings in a specific geographic region, as well as broader campaigns, with a nexus to that region, targeting the election as a whole. There were multiple pieces of intelligence, on different activities, collected at different times, from different sources, subject to different caveats and considerations, disseminated (or not) at different moments, in different formats, to different recipients. 

Decisions regarding whether, when, and how to disseminate this intelligence were the subject of disagreement, uncertainty, and lack of communication within CSIS. This disconnect was largely between intelligence officers collecting intelligence in the region, and those responsible for disseminating that intelligence at National Headquarters (NHQ) (NHQ includes both the [**dedicated unit in NHQ combining operational and analytical capabilities (hereafter referred to as “dedicated unit in NHQ”)**]  and the CSIS executive). Put simply, intelligence officers did not understand why some of the intelligence they collected was either not disseminated at all or disseminated following what they perceived to be atypical delays. NHQ, by contrast, often had reasons for not disseminating (or delaying) intelligence – typically tied to the unique nature of political foreign interference – that were not communicated or, in the absence of standard criteria or rationale, appeared arbitrary.

Intelligence related to PRC foreign interference in a particular riding is a case in point. [**One sentence deleted to remove injurious information. The sentence discussed the date(s) of collection and the threat activities described by the intelligence**]. The desk collecting and analyzing this intelligence believed it was worthy of being placed into an Intelligence Report for dissemination, particularly because it related directly to the election. In [**Fall 2021**], multiple emails were sent from the region to the [**dedicated unit in NHQ**] requesting an explanation as to why the information had not been disseminated. Eventually, the intelligence was placed into an Intelligence Report (***) and disseminated on [**redacted**] 2021. To the desk, this delay (***) significantly reduced the impact of the information.  

Additional intelligence [**redacted**] regarding other examples/instances of PRC foreign interference was never disseminated. In [**redacted**] 2021, a regional analyst drafted an analytical product incorporating this intelligence in order to detail [**redacted**] PRC foreign interference. However, a senior analyst at the [**dedicated unit in NHQ**] found that the draft product insufficiently contextualized [**redacted**] PRC foreign interference. While the regional desk recognized [**redacted**] it nonetheless believed that appropriate caveats (as are often included in CSIS reporting [**redacted**]) could have sufficiently contextualized the information.  

[**Dedicated unit in NHQ**], by contrast, believed that [**redacted**] problematized the intelligence, such that reporting it would require “contextualizing [**redacted**]. The concern was that the [**redacted**] information [**redacted**] if disseminated absent this context and characterization. For the region, this perceived reticence to push out collected information suggested that different standards were being applied to intelligence on political foreign interference.

There were also challenges and disagreements with respect to intelligence pertaining to broader interference campaigns. Following the election, a political party sent a letter to PCO detailing what they believed to be foreign interference against their candidates in thirteen federal ridings. At the core of the party’s concerns was an online disinformation campaign directed against them.

The SITE Task Force, specifically CSIS and GAC’s Rapid Response Mechanism (RRM) team, devoted significant analysis to this campaign. Ultimately, neither CSIS nor the RRM definitively linked the campaign directly to the PRC. The SITE Task Force’s After Action Report for the 2021 election, finalized in December 2021, concluded that [**one sentence edited to remove injurious information. The sentence summarized the SITE Task Force’s conclusion that it could not definitively link online narratives against the political party to a foreign state actor**]

However, prior to the publication of this report, in [**redacted**] 2021, CSIS collected intelligence [**redacted**] the online disinformation campaign against the political party.

There was disagreement within CSIS as to how to characterize [**redacted**] in the online campaign, and whether or not intelligence about [**redacted**] should or should not be disseminated as intelligence indicating PRC foreign interference. [**Two sentences deleted to remove injurious information. The sentences discussed competing perspectives between the region and a dedicated unit in NHQ regarding how to characterize intelligence regarding potential foreign interference activities**]

The crux of these competing perspectives was differing orientations to, and appreciation for, the sensitivities associated with reporting about political foreign interference, which manifested in different attitudes regarding the threshold for intelligence reporting. [**Two sentences deleted to remove injurious information. The sentences described competing interpretations within CSIS with respect to certain intelligence on possible foreign interference activities, and corresponding differences of opinion regarding dissemination of that intelligence**] This would ensure consumers of the intelligence that CSIS was not simply reporting on the normal political activity [**redacted**] routinely involved in the political process, but rather on activities which posed a threat to Canada’s national security.  

A draft Intelligence Report detailing [**redacted**] in foreign interference during the 2021 election was not disseminated. Rather, this intelligence was repurposed into a more general product on [**redacted**] foreign interference activities overall. In July 2022, [**dedicated unit in NHQ**] advised the region that they were delaying publication of the longer intelligence product until they could secure [**redacted**]for the inclusion of [**redacted**] SIGINT as part of the analysis. The region, by contrast, felt that the product as drafted sufficiently established [**redacted**] threat activities, and ought to be disseminated right away. Given that CSIS could itself view the [**redacted**] SIGINT, delaying dissemination to include this information in the product suggests CSIS felt the need to convince consumers of CSIS’s assessment [**redacted**] rather than simply providing that assessment in its capacity as the security intelligence service of Canada. [**Dedicated unit in NHQ**] further noted that the CSIS executive planned to discuss the product with senior officials outside of CSIS (including the NSIA and the Clerk of the Privy Council) prior to finalization.

Figure 3: Graphic of Key dates, dissemination of intelligence *** in 2021 election

Figure 3. Key dates, dissemination of intelligence [**redacted**] in 2021 election

[**Figure has been edited to remove injurious information**]

Discussions about the product continued over the winter and spring of 2023, culminating in a decision to publish the product in July 2023 for CSIS-only distribution. As of November 2023, CSIS’s intelligence regarding the [**redacted**] potential involvement in foreign interference activities against the 2021 election has not been disseminated in a written intelligence product outside of CSIS, [**redacted**] years since it was initially collected.

Evaluating CSIS’s dissemination of intelligence

Finding 1: NSIRA found that CSIS’s dissemination of intelligence on political foreign interference during the 43rd and 44th federal elections was inconsistent. Specifically, in certain instances:

  • The rationale for decisions regarding whether, when, and how to disseminate    intelligence was not clear, directly affecting the flow of information; and
  • The threat posed by political foreign interference activities was not clearly   communicated by CSIS.

Finding 2: NSIRA found that CSIS’s dissemination and use of intelligence on political foreign interference was impacted by the concern that such actions could interfere, or be seen to interfere, in the democratic process.

Finding 3: NSIRA found that CSIS often elected to provide verbal briefings as opposed to written products in disseminating intelligence on political foreign interference during elections.

Finding 4: NSIRA found that there was a disconnect within CSIS between a region and National Headquarters as to whether reporting on political foreign interference was subject to higher thresholds of confidence, corroboration and contextualization for dissemination.

Within CSIS, political foreign interference is considered a subset of foreign interference more generally, while investigations touching on democratic institutions and processes are subsumed within broader procedures governing CSIS’s treatment of Canadian Fundamental Institutions.  However, intelligence on political foreign interference presents several distinct challenges which are not addressed in policy or guidelines.

CSIS confronted a basic dilemma. On one hand, information about foreign interference in elections was a priority for the government, and CSIS’s collection apparatus was geared toward investigating political foreign interference. On the other, CSIS was sensitive to the possibility that the collection and dissemination of intelligence about the election could itself be construed as a form of election interference. A basic tension held: any action – including the dissemination of intelligence – taken by CSIS prior to or during an election must not, and must not be seen to, influence that election. 

This dynamic was known within CSIS, but is not formally stated in policy or guidelines. Even more importantly, the specific criteria or considerations by which CSIS might balance these potentially competing imperatives are opaque. Absent their clear articulation, decisions appeared arbitrary. It was not always clear, particularly to those collecting intelligence, what the general rationale and/or policy guiding the dissemination of intelligence on political foreign interference was, let alone how that rationale/policy applied to specific decisions. Absent this clarity, frustration mounted (as one email opined, “if we’re not going to inform and share what we know, why are we collecting it?”).

Further, there was no clear basis to justify a decision to take action (including to outwardly report information), leading to a natural risk aversion on the part of decision-makers. Inevitably, this created frustration for those presenting decision-makers with options. Finally, because the rationale remained amorphous, there was no possibility of reasoned discussion and debate within CSIS regarding the proper calibration between the competing imperatives (to inform, but not to influence), nor any consistency in how they were balanced.

There were several instances in which intelligence was not placed into short, raw Intelligence Reports but instead held back for inclusion in longer, analytical pieces. The unique dynamics of political foreign interference may suggest that, in general, such analytical products are better vehicles for reporting collected information; as it stood, the decisions appeared ad hoc, to the point of suggesting a reluctance to place information in Intelligence Reports, as is CSIS’s typical dissemination process.

Likewise, the preference for oral briefings as the mode of dissemination during elections represented a deviation from CSIS’s most common dissemination practices. Whether justified or not, this deviation suggested special practices associated with political foreign interference in the absence of policy or procedures articulating what those special practices are or ought to be, while also creating challenges for tracking and documenting the provision of information.

This opacity with respect to process extended to approvals for counter political foreign interference activities. Whereas formal approval authority for a particular activity might reside at a certain level (for example Regional Director General), there was a recognition that the informal approval level for counter political foreign interference-related activities was the senior executive, including the Deputy Director of Operations or Director. Although not dictated by policy, it also became standard practice to “sensitize” or inform officials from PCO before CSIS could undertake certain counter-foreign interference activities.

For example, prior to the 2021 election, CSIS conducted Protective Security Briefings (PSB) in an effort to educate Members of Parliament (MPs) as to the threat of foreign interference. A regional desk planned a set of PSBs for a limited set of local MPs they determined to be at higher risk for being targets of political foreign interference. However, NHQ directed that the PSBs be paused, so that the [**dedicated unit in NHQ**] could devise a national PSB strategy along the same lines, based on lessons learned from a similar campaign prior to the 2019 election.

The national campaign was designed [**one sentence edited and one sentence deleted to remove injurious information. The sentences described CSIS methods and tactics**]. Such interest, if revealed, might be construed as inappropriate CSIS involvement in the democratic process.

Likely as a consequence of this sensitivity, the national campaign was further complicated by an extensive approvals process, which ultimately expanded to include sensitizing officials at PCO and Public Safety prior to conducting the briefings. In the end, the complexity and delay associated with the national campaign meant that it could not occur as planned. Instead, the region proceeded with as many of its initially planned PSBs as it could prior to the start of the writ period. Contact with MPs during the writ period was deemed inappropriate.

General sensitivities associated with counter-political foreign interference activities also influenced a [**one sentence edited and three sentences deleted to remove injurious information. The sentences described the objectives and implementation of a CSIS operational activity**]. This was a “conscious choice…due to political sensitivities” which, CSIS assessed, may have reduced the intended strategic impact of the [**CSIS operational activity**].  

Finally, sensitivities also influenced the dissemination of specific intelligence products. Most prominently, as discussed above, intelligence collected in [**redacted**] 2021 was ultimately published in an intelligence product for CSIS-only distribution in July 2023. After extensive delay, revision, and consultation, a senior CSIS executive decided not to disseminate the product more widely (see Case Study 3). 

At the core of the issues discussed above is a lack of clarity and communication pertaining to CSIS’s investigations of political foreign interference. Overall, the perception arose within CSIS that rules and decisions were being made, and frequently changed, absent a coherent strategy or guiding principles.

Intelligence is not evidence. Nor is it wild speculation, conjecture, or rumour. In theory, the threshold or standard for what intelligence is disseminated is uniform across the spectrum of threat-related activities. In practice, however, the cases examined demonstrate that, at the very least, there was a perception that standards were higher for intelligence related to political foreign interference. Although a senior CSIS executive told NSIRA that intelligence standards for political foreign interference were not different as compared to other threat-related information, they also outlined that there are sensitivities associated with disseminating intelligence about an individual involved in politics. For example, such information could have an impact on the career of that individual, including their ability to participate in democratic processes.

In some instances, regional collectors and analysts believed that CSIS NHQ (both [**dedicated unit in NHQ**] and senior management) placed too great an emphasis on “smoking guns” in terms of connecting activities directly to state actors.

Pushing for additional corroboration is a fundamental part of intelligence work. Standards, by their very definition, are meant to be uniform, and not differ by circumstance. Yet insisting that the push for corroboration or the standards for dissemination are the same for political foreign interference as compared to other reporting is untenable if it does not accurately reflect how decisions are made in practice. The failure to appreciate and account for the distinct nature of political foreign interference leads to confusion and consternation.

Political foreign interference often operates in the “grey-zone” between legitimate, overt political/diplomatic activity and covert, clandestine interference. Many of the consumers of intelligence on political foreign interference are familiar with political (in the case of ministers, members of parliament, and political parties) or diplomatic (for example officials at GAC) activities. This creates challenges for CSIS with respect to intelligence consumers in terms of making clear to consumers why the reporting is important and threat-related.

In short, CSIS is reporting about activities taking place in the milieu of the clients they serve. The practical implication is that any intelligence that is disseminated must sufficiently distinguish between legitimate and illegitimate activity. This can be difficult in practice, especially as the nature of PRC foreign interference in particular consists of the steady accumulation over time of activities and pressure that, in isolation and absent additional context, may appear innocuous, but in sum constitute a campaign to interfere in Canada’s democracy. PRC foreign interference is a growing rumble, not a loud bang.

There are several key shortcomings related to CSIS’s dissemination and use of intelligence on political foreign interference. First and foremost, CSIS has not clearly articulated its risk tolerance for counter political foreign interference activities. A defined risk tolerance allows those approving action to understand the parameters within which CSIS is comfortable operating.

Second, and relatedly, the approvals process for counter politicalforeign interference activities does not always reflect actual practice. For example, there are few clear directions and expectations in existing CSIS policy regarding when and why external entities – such as Public Safety and PCO – will be consulted prior to particular actions or activities, and none that account for the specific dynamics of counter political foreign interference activities noted above. Of note, in May 2023 the Minister of Public Safety issued a Ministerial Direction to CSIS on Threats to the Security of Canada Directed at Parliament and Parliamentarians, which outlines consultation principles in that specific context. However, the MD does not pertain to foreign interference against other democratic institutions.

Third, CSIS does not make explicit its thresholds for production and dissemination specifically related to intelligence on political foreign interference. That is, the level of confidence and corroboration required for collected information to be placed in an intelligence product, and the level of additional contextualization, such that the product can be disseminated to Government of Canada clients. The sensitivities associated with this type of intelligence, and the corresponding requirements for greater confidence and corroboration as compared to other types of security intelligence, should be acknowledged. For example, CSIS may wish to evaluate whether [**redacted**] criteria for Intelligence Report production are well suited for the specific nature of intelligence on political foreign interference.   

What is needed, ultimately, is a comprehensive policy and strategy specifically pertaining to all aspects of how CSIS engages – investigates, reports about, and takes action against – threats of political foreign interference. This would bring coherence across all regions and NHQ, and generally facilitate greater understanding and communication between levels of the organization, from intelligence officers to analysts to senior management. At the same time, it would signal to Government of Canada stakeholders, and in particular senior decision-makers, that CSIS has carefully considered all aspects of political foreign interference, including its unique sensitivities, and is reporting and advising on those threats using rigorous standards and thresholds. 

Canada is not alone in facing PRC political foreign interference. In the last several years, all of Canada’s Five Eyes partners (Australia, New Zealand, the US, and the UK) have publicly acknowledged the threat posed by PRC foreign interference to their respective democracies. There is a significant opportunity to leverage these shared experiences into best practices.

Recommendation 1: NSIRA recommends that CSIS develop, in consultation with relevant government stakeholders, a comprehensive policy governing its engagement with threats related to political foreign interference. This policy should:

  • make explicit CSIS’s thresholds and practices for the communication and dissemination of intelligence regarding political foreign interference. This would include the relevant levels of confidence, corroboration, contextualization and characterization necessary for intelligence to be reported;
  • clearly articulate CSIS’s risk tolerance for taking action against threats of political foreign interference;
  • establish clear approval and notification processes (including external consultations) for all activities related to countering political foreign interference;
  • make clear any special requirements or procedures that would apply during election/writ periods, as necessary, including in particular procedures for the timely dissemination of intelligence about political foreign interference; and,
  • consider best practices from international partners (in particular the Five Eyes) regarding investigating and reporting about political foreign interference.

Part 2: The SITE Task Force and the CEIPP Panel

In the wake of well-documented Russian foreign interference in the 2016 US presidential election, the Government of Canada instituted a suite of measures meant to protect the integrity of federal elections. Three such measures are pertinent to the present review:

  • Critical Election Incident Public Protocol (CEIPP) Panel. Established by Cabinet directive, the CEIPP is in place during the election period and administered by a panel of senior public servants.  The Panel assesses security and intelligence information to determine whether to make a public announcement that “an incident or an accumulation of incidents has occurred that threatens Canada’s ability to have a free and fair election.” The Protocol was not invoked – that is, no public announcements were made – in either the 2019 or 2021 election.
  • The Security and Intelligence Threats to Election (SITE) Task Force. The SITE Task Force is composed of representatives from CSIS, CSE, the RCMP, and GAC. The primary purpose of the Task Force is to provide coordinated intelligence reporting on threats to elections to the CEIPP Panel.
  • G7 Rapid Response Mechanism (RRM). Established at the 2018 G7 meeting in Charlevoix, Canada’s RRM is housed within GAC, and focuses on foreign threats to democratic processes via threat analysis and reporting on online information manipulation activities by foreign state actors. The RRM team serves as GAC’s representative on the SITE Task Force.

These entities played significant roles with respect to the flow of intelligence on PRC foreign interference during the 2019 and 2021 elections. In essence, the SITE Task Force served – or was intended to serve – as a conduit for threat intelligence, while the Panel stood in receipt of that information, with a unique mandate to communicate, or not, with the Canadian public regarding the information it was provided.

Finding 5: NSIRA found that the SITE Task Force and the CEIPP Panel were not adequately designed to address traditional, human-based foreign interference. Specifically:

  • The SITE Task Force focuses on threat activities during the election period, but traditional foreign interference also occurs between elections.
  • Global Affairs Canada’s representation on the SITE Task Force focused on online foreign interference activities.
  • The CEIPP Panel’s high threshold for a public announcement is unlikely to be   triggered by traditional foreign interference, which typically targets specific ridings.

The structure and orientation of both the Task Force and the Panel were shaped by the imperative to protect elections against widespread and coordinated foreign interference occurring up to and including Election Day. That is, to protect Canadian elections from the type of foreign interference (largely online disinformation) witnessed in the US and elsewhere.

At the same time, the security and intelligence community recognized that human-based, so-called “traditional” foreign interference had been, and continued to be, the most significant threat to Canadian democratic processes and institutions. For example, the SITE Task Force’s 2021 threat overview noted that foreign interference actors predominately used human-based tactics “partly as a result of the way that Canada conducts its elections…but also due to the efficacy of HUMINT-based influence operations as compared to cyber activities given the structure of the Canadian electoral system.” Overall, the predominance of traditional foreign interference was known prior to 2019, and subsequent experience reinforced this perception.

Despite this recognition, the parameters of the SITE Task Force and the CEIPP Panel are not aligned with the nature of the threat stemming from traditional foreign interference.

In a post-election Panel debrief, a Panel member noted that a major, widespread and successful interference campaign did not occur and that the election had been “clean” despite “some stuff” occurring. The foreign interference in a specific riding [**redacted**], according to this panelist, was “not material to the election” and therefore not of direct concern to the Panel’s remit. At the same meeting, the CSIS Director asserted that the “strongest case” of PRC foreign interference during the election were the events cited in this riding. The Director also lamented that “the machine” (the SITE Task Force and the CEIPP Panel) was not set up to address foreign interference outside of the election period.

Unlike broad patterns or campaigns (such as widespread online disinformation), intelligence on traditional foreign interference in elections is typically granular and specific, pertaining to the activities of individuals in particular ridings. Assessing the impact of those activities at the riding-by-riding level requires receiving and analyzing all relevant intelligence on an ongoing basis. This is doubly challenging given the short time frame in which elections occur.

Similarly, a core feature of traditional foreign interference is that it takes place over the long term, and is not confined simply to election periods. While the SITE Task Force is in continual operation, its capacity and operational tempo is reduced outside election periods. Moreover, its focus remains on the election period, and on the outcome/integrity of the vote on Election Day. These features undermine the Task Force’s ability to fully address traditional foreign interference, which is not confined to election periods and threatens democratic institutions more broadly. 

Consider also the inclusion of the RRM team as GAC’s representation on the Task Force. The RRM is specifically geared toward the online space, and monitoring social media for potential foreign interference activities, including the spreading and amplification of disinformation. By contrast, GAC’s capacity to analyze intelligence related to, and devise potential responses against, traditional foreign interference is not sufficiently represented on the Task Force. Traditional foreign interference frequently runs through [**redacted**]. There is a significant role for GAC to play in terms of response (for example issuing démarches or expelling diplomats) and interpretation (for example on the difference between foreign interference and legitimate diplomatic activity) that extends beyond the RRM team’s specific remit.

Finally, the CEIPP Panel’s threshold for a public announcement as to the integrity of the election is geared toward broad, systematic foreign interference such as that constituted by online disinformation campaigns or other cyber activities. This means that, in practice, the public may hear nothing from the Panel, even as significant foreign interference takes place, so long as that interference remains below what is recognized to be an incredibly high threshold.

A lack of public communication – transparency – creates several potential issues and can be interpreted in multiple ways. If information about specific foreign interference attempts emerges following the election, no communication during the election may be interpreted as a lack of action, or lack of willingness to take action, on the part of the government. If no such information emerges, the lack of communication, and associated implication that the integrity of the election was not threatened by foreign interference, may give a false impression as to the level of foreign interference that occurred.

Recommendation 2: NSIRA recommends that the SITE Task Force align its priorities with the threat landscape, including threats which occur outside of the immediate election period.

Recommendation 3: NSIRA recommends that Global Affairs Canada (GAC) and the Privy Council Office ensure that GAC’s representation on the SITE Task Force leverages the department’s capacity to analyze and address traditional, human-based foreign interference, in addition to the online remit of the Rapid Response Mechanism Team.

Recommendation 4: NSIRA recommends that the Privy Council Office empower the CEIPP Panel to develop additional strategies to address the full threat landscape during election periods, including when threats manifest in specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

This final section of the report steps away from the election-specific context to consider the flow of intelligence on PRC foreign interference between 2018 and 2023 more broadly. As noted, political foreign interference is everywhere and all the time. The intelligence community collects intelligence on PRC political foreign interference on an ongoing basis. This intelligence is shared both horizontally within the community and vertically to senior decision makers, including elected officials.

The responsible sharing of intelligence between organizations is an important feature of a healthy security and intelligence community. While sensitivities, particularly of sources and methods, make the classification of material necessary, and the need-to-know principle further conscribes the circle of individuals who may view certain information, the cross-fertilization of intelligence enhances the ability of organizations to inform decision-makers from the perspective of their particular mandates.

Finding 6: NSIRA found that the limited distribution of some CSIS and CSE intelligence to senior officials-only reduced the ability of the Royal Canadian Mounted Police, Global Affairs Canada, and the Privy Council Office to incorporate that intelligence into their analysis.

With respect to intelligence on PRC foreign interference, reporting from the core “collectors” (CSIS and CSE) informed intelligence analysis by the other security and intelligence organizations under review (GAC, the RCMP, and PCO).

However, this cross-fertilization was not without issues. For example, a GAC assessment from late August 2021 discusses CSIS intelligence indicating PRC political interference but omits other, specific CSIS intelligence directly relevant to GAC’s assessment. Given the sensitivity of the intelligence, however, the CSIS Intelligence Report pertinent to, but missing from, GAC’s analysis was sent to “named recipients only”, meaning that although senior officials at GAC had access to it, analysts within GAC’s Intelligence Bureau did not. This dynamic was typical of many Intelligence Reports produced and disseminated on PRC political foreign interference, making it challenging, on occasion, for recipient organizations to incorporate that intelligence into their own analytical assessments. 

In the case of the expulsion of PRC diplomat Zhao Wei in May 2023,  [**redacted**]. (At the same time, disagreements persisted between CSIS and GAC as to what does or does not constitute “legitimate diplomatic activity”.)

A similar dynamic pertained to CSE SIGINT on PRC foreign interference. While many End Product Reports – CSE’s standard intelligence product – were incorporated into GAC, PCO, and RCMP analysis, some of the most pertinent intelligence was classified at a level which significantly limited its distribution, due to the sensitivity of the collection method. This intelligence was available to a limited number of individuals (including senior officials) within government who possessed the requisite indoctrination.

There is a balance to be struck between protecting sensitive information by limiting its distribution and ensuring pertinent information is shared to inform intelligence analysis and potential action across the government. NSIRA did not assess whether specific intelligence products were or were not “over-classified”, other than to note that decisions regarding classification have direct consequences for dissemination.

Finding 7: NSIRA found that CSIS and Public Safety did not have a system for tracking who received and read specific intelligence products, creating unacceptable gaps in accountability.

Intelligence is shared within the Government of Canada in a multitude of ways. CSIS intelligence in particular may be shared directly by secure email, or by uploading products to platforms such as the Canadian Top Secret Network (CTSN) and CSE’s SLINGSHOT repository.  Hard copies of products can be disseminated via CSE’s Client Relations Officer (CRO) program, with embedded officers serving clients in various departments and agencies. Some departments, such as GAC and Public Safety, have their own in-house intelligence dissemination officers. Secure emails with intelligence products in attachment provide instructions to contacts regarding who in the department should receive the product (for example Deputy Ministers and Ministers).

During the review period, CSIS lacked the ability to definitively track who had received and read its intelligence. Partly this was a consequence of the internal tracking systems of the various recipient departments, who may not have comprehensively captured this data. In the end, however, it is incumbent on CSIS, as the originator of sensitive information, to control and document access.

Intelligence on the PRC targeting of a Member of Parliament

The consequences of not knowing who has read what manifested in the controversy regarding intelligence related to the PRC’s targeting of a sitting Member of Parliament.

In May 2023, media reporting revealed that the Government of Canada had intelligence that a Member of Parliament and his family members had been “targeted” for sanction by the PRC.

The media and public conversation centered around two CSIS products. First, a July 2021 CSIS Intelligence Assessment [**sentence edited to remove injurious information. The sentence described the contents of the Intelligence Assessment, which included intelligence related to PRC foreign interference activities**]. And second, a May 2021 “Issues Management Note” sent by CSIS to senior government officials to inform them that CSIS would be briefing two MPs (including the Member of Parliament in question) on PRC threat-activities against them.

The focus on these two products was misplaced. Neither was the mechanism through which the Minister and Deputy Minister of Public Safety were initially meant to be informed of the PRC’s threat activities against the Member of Parliament and his family.

Rather, [**prior to May 2021**] there was [**CSIS intelligence**] related to the PRC’s targeting of the Member of Parliament. [**CSIS intelligence was**] sent to named recipients lists which included the Deputy Minister and Minister of Public Safety. [**CSIS intelligence**] was disseminated by secure email directly to individuals and departmental contacts. The departmental contacts were directed to provide the information to named senior individuals, including the Minister of Public Safety, as these officials would not have had direct access to secure email. Additional named recipients of [**CSIS intelligence**] included the NSIA, the Clerk of the Privy Council, the Deputy Minister of National Defence, the Foreign and Defence Policy Advisor, the Chief of CSE, and other senior officials at GAC, PCO, DND, CSE, and Public Safety.

CSIS disseminated [**redacted**] 2021. [**Sentence deleted to remove injurious information. The sentence summarized CSIS intelligence**] Public Safety indicated to NSIRA that [**CSIS intelligence**] was distributed internally the week of [**redacted**] 2021 and that the “only indication is that it was sent to senior management.”  

Next, on [**redacted**] 2021, CSIS disseminated [**redacted**] containing intelligence that [**Sentence edited to remove injurious information. The sentence summarized CSIS intelligence**] Public Safety indicated to NSIRA that [**CSIS intelligence**] was distributed internally the week of [**redacted**], 2021 and that the “only indication is that it was sent to the Minister.”

Finally, on [**redacted**] 2021, CSIS disseminated [**Sentence edited to remove injurious information. The sentence summarized CSIS intelligence**] The information was required urgently as [**redacted**]. Public Safety indicated to NSIRA that it had no record of receiving this [**CSIS intelligence**].

Figure 4: Graphic of Key dates, dissemination of intelligence on targeting of a federal MP

Figure 4. Key dates, dissemination of intelligence on targeting of a federal MP

[***Figure has been edited to remove injurious information***]

As noted above, Public Safety stated that at least one [**piece of CSIS intelligence**] was provided to the Minister of Public Safety, likely as part of a weekly reading package in [**redacted**] 2021. This would have preceded by several months both the Issues Management Note of May 2021 and the Intelligence Assessment of July 2021. There is no indication that [**redacted**] was provided to the minister, despite the fact that he was a named recipient on the distribution list.

Most problematic is Public Safety’s inability to account for [**redacted**]. In the wake of the public controversy in 2023, CSIS and Public Safety compiled a chronology of relevant events. Public Safety suggested that perhaps “human error” accounted for the gap in its records, and that the file may have accidently been deleted. Further, the CSIS Director and the NSIA requested that the joint CSIS-PS chronology reflect the fact that “the distribution of a document does not indicate that a document was received or read by the recipient.” This notion – of a possible black hole between the dissemination of a critical product and its receipt on the other end – is a demonstrably unacceptable state of affairs.

As this case makes clear, it is incumbent on CSIS to implement a system that comprehensively tracks the dissemination and receipt of its own intelligence, including, in the case of certain prioritized intelligence, who has read specific products. Prioritized intelligence could include highly sensitive and urgent intelligence, for example regarding threats of foreign interference against elections or other key democratic institutions or processes.

Recommendation 5: NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received intelligence products. In the case of highly sensitive and urgent intelligence, this should include documenting who has read intelligence products.

At the same time, tracking who has read what is not a panacea. There must be interest on the part of consumers for the intelligence they receive, and an understanding as to how the intelligence can support the fulfillment of their responsibilities.

Finding 8: NSIRA found that the dissemination of intelligence on political foreign interference from 2018 to 2023 suffered from multiple issues. Specifically:

  • Intelligence consumers did not always understand the significance of the intelligence they received nor how to integrate it into their policy analysis and decision-making;
  • There was disagreement between intelligence units and senior public servants as to whether activities described in specific intelligence products constituted foreign interference or legitimate diplomatic activity.

Finding 9: NSIRA found that there was disagreement between senior public servants and the NSIA as to whether intelligence assessments should be shared with the political executive. Ultimately, the NSIA’s interventions resulted in two products not reaching the political executive, including the Prime Minister.

Finding 10: NSIRA found that the NSIA’s role in decisions regarding the dissemination of CSIS intelligence products is unclear.

In multiple briefings and interviews from across the community, NSIRA heard about the challenge of articulating the “so-what” in intelligence analysis. Part of this challenge stems from so-called “literacy gaps” between the intelligence and policy communities; that is, low policy literacy on the part of intelligence analysts, and low intelligence literacy on the part of policy analysts or policymakers. This gap can create confusion as to what intelligence is for, and what can be done about the threats that intelligence describes.

Consider for example the emphasis on “actionable” intelligence or “recommendations” for action that consumers look to the intelligence community to provide. Not all intelligence will come with these characteristics. Instead, intelligence may be provided for information and awareness purposes only (including to increase the salience of important trends and threats). Intelligence analysts explained that, ultimately, it is the consumers of intelligence who have the mandate to take action (including to shape strategic policy), while the analyst’s job is to provide them with information that best allows them to do so.

The core function of the intelligence process is the provision of intelligence analysis to policymakers. In-depth analysis – the weaving together of disparate data into a coherent narrative, with judgments and assessments as to the implications of the information presented – is the purview of dedicated units within security and intelligence agencies, such as CSIS’s Intelligence Assessment Branch (IAB) and PCO’s Intelligence Assessment Secretariat (IAS). It is the job of analysts to contextualize collected intelligence for senior consumers.

The dissemination of intelligence to the political executive can occur verbally, in both formal and informal briefings, by senior public servants, such as Deputy Ministers and, in the case of the Prime Minister, the NSIA. At the same time, written analytical products can provide the political executive with key analysis and pressing takeaways regarding threats to the security of Canada.

PCO “Special Report”

In the fall of 2021, the acting NSIA received a series of briefings from PCO IAS on PRC foreign interference. In order to understand more about the issue the acting NSIA commissioned a “Special Report” that would combine foreign intelligence (the traditional purview of IAS) with domestic, security intelligence (CSIS’s domain).

In broad terms, the Special Report was intended to provide a “summary assessment of China’s foreign interference (FI) activities, both in Canada and internationally.” The report was based on over [**redacted**] CSIS reports, [**redacted**] reporting, and open source analysis. Key judgements included that the “Canadian intelligence community is of the consensus view that China poses the most significant foreign interference (FI) threat to Canada” that “Canada remains [**redacted**] to China’s FI efforts”, and finally that “China’s FI efforts are sophisticated, persistent and multidimensional. Electoral interference is only a subset of China’s broader FI efforts.”  

In late November 2021, IAS shared a draft of the report with CSIS for comment and feedback. A senior CSIS executive responded positively to the product, suggested a few areas for improvement, and provisionally approved PCO’s proposed dissemination list, contingent on the CSIS Director also reviewing the report. The list included “Senior PMO” as well as deputy ministers (or equivalent) across relevant departments (Justice, GAC, DND, Public Safety, CSIS and CSE). At the same time, PCO IAS requested that its production team provide a copy of the report to the Clerk of the Privy Council, the Deputy Clerk, and PMO (noting that the acting NSIA had already received a copy).

This did not occur. Shortly following the emailed request, a senior employee within IAS contacted the production team in person and told them not to share the product as instructed, as IAS had “determined that a feedback and steerage discussion with the a/NSIA…was required first, before finalizing the report and sharing it more broadly.” In mid-December, the acting NSIA provided additional feedback on the paper, which was incorporated into a second draft. This feedback concerned the tone of the paper, and in particular clarifying whether what the paper described included standard diplomatic activity.

In January 2022, a new NSIA was appointed. IAS briefed the new NSIA on the Special Report, and provided them, along with other senior executives in the NSIA’s branch, a hard copy with a covering note. The covering note was sent by the Assistant Secretary of IAS (the most senior individual within IAS) and addressed to the NSIA. It briefly described the contents of the Special Report and explicitly recommended that the report be approved and “provided to select Deputy Ministers and Cabinet Ministers.”

In February 2022, there were no bilateral meetings between the Assistant Secretary of IAS and the NSIA, and no further discussions on the Special Report. PCO explained to NSIRA that the Freedom Convoy in Ottawa and Russia’s invasion of Ukraine were the government’s top security priorities during this period. In early March 2022, elements of the Special Report were included in talking points prepared for the NSIA ahead of a briefing. NSIRA did not obtain the details as to who the NSIA briefed at this time as they were withheld by PCO as a Cabinet confidence. In April 2022, an electronic version of the Special Report was made available to the NSIA [**redacted**] but was not accessed during that time. PCO had no further records of any discussions regarding the Special Report, until renewed interest following portions of the report appearing in media reporting in early 2023.

Figure 5: Graphic of Key dates, PCO “Special Report”

Figure 5. Key dates, PCO “Special Report”

[**Figure has been edited to remove injurious information**]

Ultimately, the Special Report remained in draft form, and was never approved, finalized, or disseminated. While several senior public servants at CSIS and PCO read draft versions of the product,  it never reached Cabinet Ministers or the PMO.

PCO cited several reasons to NSIRA as to why the Special Report was never disseminated. The relevant portion of their response is provided in full here:

The report was not published for various reasons. First, its original purpose was to inform the then A/NSIA…on foreign interference, which it accomplished. [The] A/NSIA, [the new] NSIA [as of January 2022], as well as other senior PCO officials benefitted broadly from the analysis, which helped inform the development of policy advice and engagement with counterparts. Furthermore, the document was drafted immediately prior [to] the “Freedom Convoy” and the start of the Russia-Ukraine war. The Government, the NSIA and, to some extent, IAS were focused on these pressing priorities. In addition, the domestic analysis portion of the assessment was largely based on already published and disseminated CSIS material. While depicting an alarming situation, it did not refer to any specific issue that would have required a government decision or an immediate tactical response.

As such, given the fact that the document had fulfilled its purpose, other pressing priorities had emerged, and that the NSIA had outstanding questions and comments pertaining to the document, [the NSIA] did not direct [the Assistant Secretary of IAS] to publish the document, nor did [the Assistant Secretary of IAS] choose to publish the product on [their] own authority. This “test-case” analysis – which combined domestic and foreign intelligence – was nonetheless useful and demonstrated the potential of that type of assessment moving forward.

PCO did not specify to NSIRA what the NSIA’s “outstanding questions and comments pertaining to the document” were, and how they may have contributed to the decision not to finalize the report and disseminate it to the political level. Nor did the NSIA indicate the authority of the Assistant Secretary of IAS to disseminate intelligence products contrary to a decision from the NSIA. Moreover, the expressed purpose of the report was to provide a general overview of PRC foreign interference, not to provide information requiring a specific “government decision or…immediate tactical response.” The point, in other words, was precisely to depict “an alarming situation”, for the awareness of decision-makers. Indeed, the rationale outlined by PCO above belie sentiments expressed in internal PCO correspondence, in which analysts and management alike discuss the import of the Special Report, in addition to the support and concurrence for the report’s analysis provided by a senior CSIS executive and a senior CSIS intelligence analyst. There was a feeling within IAS that the report would be impactful, given the full view it provided of PRC foreign interference activities. Elsewhere, a CSIS executive noted that the product was being developed “to provide to decision makers so they understand the enormity of the situation.” This feeling is reflected in the aforementioned recommendation, in January 2022, that the Special Report be shared with members of Cabinet.

CSIS “Targeting Paper”

In early 2021, a CSIS analyst produced a report combining SIGINT [**one sentence edited and one sentence deleted to remove injurious information. The sentences discussed collection methods and technical systems**]. The report provided analysis of PRC foreign interference activities against federal Canadian political actors [**redacted**]. The intent was to provide an overview to policymakers of the PRC’s strategy and tactics related to the “targeting” (for influence/interference) of [**redacted**]. CSIS characterized the report as the “most complete and detailed analysis of PRC foreign interference directed against political actors produced to date.”

A final draft of the report – known as the “Targeting Paper” – was completed in June 2021. According to CSIS, the report was circulated at this time to a small number of senior officials (though NSIRA cannot confirm this as it is not reflected in CSE tracking logs for the product). Nonetheless, the product remained unpublished and was not formally disseminated. 

CSIS provided several reasons as to why the report did not move forward at the time, including logistical challenges associated with the classification of the material (which made distribution difficult), the impact of COVID-19, management turnover, legal issues [**redacted**], and the overall sensitivity of the content (which required consulting on distribution with the senior executive). According to a senior CSIS executive, there was never any intent for the report not to go out, as it was considered to be an important product. 

In October 2022, the author of the report reached out to CSIS management to push for the product’s publication, given the significant interest in foreign interference generated by the media leaks. In November 2022, CSIS began coordinating [**redacted**] the report’s publication. The intent was to publish the report in CSE’s SLINGSHOT repository as a CSIS product. Over the next two months, conversations centred on the distribution list and intended “roll out” of the report. CSIS determined that it would initially go to senior public servants and, shortly thereafter, to the “political level” (e.g. relevant ministers). In early February, a limited distribution list of senior public servants was finalized. The report was then published in SLINGSHOT on February 13, 2023.

Nine days later, on February 22, the report was made inaccessible. During the period in which the product was available, records indicate that it was seen by roughly 40 public servants, including the NSIA, the Clerk of the Privy Council, and the CSIS Director.

The decision to make the report inaccessible was made by the CSIS Director, at the request of the NSIA. When asked about this decision by NSIRA, the Director’s office replied that “to the [Director’s] recollection it was decided [to pause the report] because the information was extremely sensitive and there needed to be further discussions regarding its distribution. The request was not to limit or censor the report but to ensure proper readership.” Specifically, according to the Director, the NSIA’s concern was that the “distribution list was too large given the content.” As of November 2023, no revised distribution list had been approved, and the report remained unavailable.

PCO confirmed that the NSIA’s request to pause the product was predicated on the NSIA’s belief that the initial distribution list was too wide. In addition, however, “the NSIA had posed questions for CSIS response pertaining to what possible actions could/would be taken about the intelligence contained in the report.” CSIS, for its part, made no reference to any such request in their responses to NSIRA regarding the product. Most strikingly, PCO explained that it “was also the NSIA’s view that the activity indicated in the report did not qualify as foreign interference, but was rather part of regular diplomatic practice.” PCO claims that this position was supported by unnamed Deputy Ministers. This is in stark contrast to CSIS’s characterization of the report as the most complete and detailed analysis of PRC foreign interference directed against Canadian political actors.

On February 24, a meeting was held at PCO to discuss the product. Attendees included the CSIS Director, the NSIA, the Chief of CSE, the Clerk of the Privy Council, the DM of Public Safety, the DM of GAC, and the report’s author (a senior CSIS analyst). According to CSIS, the outcome of this meeting was a request from the NSIA to produce a shorter and “sanitized” (i.e., with names [**redacted**] anonymized) version of the report specifically for the Prime Minister.

The CSIS analyst completed a Prime Minister-version of the report on March 9, 2023. As of November 2023, the Prime Minister has not seen, read, or had access to this product. The CSIS Director was unaware of this fact. In terms of dissemination, the CSIS analyst (the report’s author) explained that they required an approved distribution list, which only the Director and NSIA could provide, and that they could not action the report independently. CSIS further explained that “the Director’s office staff were aware…that no action on the PM version would be taken without a new distribution list from the [Director] and NSIA” but that “conflicting priorities during the spring and summer meant that the Director’s Office did not raise the issue with the Director.” Given that “neither the NSIA nor the NSIA’s office followed up with the Director on the status of the request for a PM version of the report” the Director was under the impression “that the PM had seen it.”

Figure 6: Graphic of Key dates, CSIS “Targeting” Paper

Figure 6. Key dates, CSIS “Targeting” Paper

[**Figure has been edited to remove injurious information**]

While CSIS was clear that this version of the report was drafted specifically for the Prime Minister, the Director noted that the ultimate decision as to whether or not to provide it to the Prime Minister rested with PCO. According to PCO, however, “the report in question was not specifically for the Prime Minister’s consumption.” This again is a jarring contrast in perspectives between CSIS and PCO. CSIS is under the impression that the outcome of the February 24 meeting was a directionfrom the NSIA to create a version of the Targeting Paper for the Prime Minister; this is difficult to reconcile with the NSIA’s position that this same product was not specifically intended for the Prime Minister. Moreover, based on CSE tracking records, no other senior officials – including from PCO or PMO – have seen the condensed version of the product either. As far as CSIS is aware, “the draft has not been actioned in any way.”

While the NSIA plays a coordinating role within the security and intelligence community, the bounds of this role are not formally delineated. Furthermore, given their proximity to the Prime Minister, the NSIA’s position on certain actions or decisions may carry considerable weight within the community. As such, the extent of their influence in decisions regarding the distribution of CSIS intelligence products is unclear. Ostensibly, the February 22 decision to “pause” the initial version of the Targeting Paper was made by the Director. In reality, the decision appears to have been made by the NSIA (recall, as an analogous example, the NSIA’s request to recall a CSIS intelligence product about foreign interference in the 2019 election; see paragraph 27, above).

The PCO Special Report and the CSIS Targeting Paper offer interesting parallels. Both products were meant to serve as synthesizing overviews of available intelligence on PRC political foreign interference. In the end, neither report was disseminated to the political executive, for similar reasons. The reports could have been provided for strategic planning purposes to policymakers; instead, the NSIA considered them in terms of the concrete actions/steps which could be taken in light of the intelligence provided and did not disseminate them further. 

There were also questions as to whether the reports actually described foreign interference, or instead recounted standard diplomatic activity, to the point of a flat disagreement in this regard with respect to the Targeting Paper. In assessing intelligence, disagreement and debate are important and healthy. Nonetheless, the delta between CSIS’s point of view and that of the NSIA in this case is significant, because the question is so fundamental. CSIS collected, analyzed, and reported intelligence about activities that it considered to be significant threats to national security; one of the primary consumers of that reporting (and the de facto conduit of intelligence to the Prime Minister) evidently disagreed with that assessment. Commitments to address political foreign interference are straightforward in theory, but will inevitably suffer in practice if rudimentary disagreements as to the nature of the threat persist in the community.

Recommendation 6: NSIRA recommends that Public Safety Canada, Global Affairs Canada, the Privy Council Office, and other regular consumers of intelligence, enhance intelligence literacy within their departments.

Recommendation 7: NSIRA recommends that the security and intelligence community develop a common, working understanding of political foreign interference.

Recommendation 8: NSIRA recommends that the role of the National Security and Intelligence Advisor to the Prime Minister, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Conclusion

The security and intelligence community is of the consensus view that political foreign interference is a significant threat to Canada, and that the PRC is a major perpetrator of this threat at all levels of government. Nonetheless, the present review of how intelligence related to PRC political foreign interference was disseminated from 2018 to 2023 (a period covering the last two federal elections) indicates that there were significant disagreements between constituent components of that community, both within and across organizations, as to whether, when, and how to share what they knew.

Three basic schisms existed. First, within CSIS: the Service struggled to reconcile competing imperatives (report but don’t interfere) given the unique sensitivities of political foreign interference, particularly in and around elections. This resulted in deviations from typical dissemination practices, and corresponding consternation on the part of some intelligence collectors and analysts.

Second, in the “machine” of election security: the SITE Task Force and CEIPP Panel were geared toward broad, systematic interference and therefore could not adequately address so-called traditional, riding-by-riding interference, despite the recognition that this type of threat is the most prevalent in Canada. The Panel’s threshold meant that it did not communicate to the Canadian public about the foreign interference it observed in either the 2019 or 2021 federal elections.

Third, between intelligence analysts and senior public servants: PCO and CSIS analysts produced overviews of what they considered to be PRC foreign interference activities (and therefore threats to national security) but which the NSIA saw as recounting standard diplomatic activity. This fundamental disagreement led, in part, to those intelligence products not reaching the political executive, including the Prime Minister.

These disagreements and misalignments underscore a basic challenge: the so-called “grey zone” whereby political foreign interference may stand in close proximity to typical political or diplomatic activity. This challenge was ever-present in the activities under review, influencing decisions about whether to disseminate and how to characterize what was shared, while raising sensitivities in terms of reporting about activities which skirt the political and diplomatic realms. The risk of characterizing legitimate political or diplomatic behaviour as a threat led some members of the intelligence community to not identify certain activities as threat activities. 

The security and intelligence community grappled with these challenges during a time of significant geopolitical change. Canada’s relationship with the PRC, in particular, has deteriorated since 2018. Not coincidently the trajectory over the review period was toward greater recognition and consensus as to the extent of the threat posed by PRC foreign interference. Yet even as the community comes into alignment, there remain significant impediments to the flow of information about this threat. The recommendations provided in this report address these deficiencies. Their aim, in the end, is to ensure that those receiving intelligence – the decision- and policy-makers ultimately responsible for the security of the country – are able to take effective, informed action.

Annex A. Findings and Recommendations

NSIRA made the following findings and recommendations in this review:

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

Finding 1: NSIRA found that CSIS’s dissemination of intelligence on political foreign interference during the 43rd and 44th federal elections was inconsistent. Specifically, in certain instances:

  • The rationale for decisions regarding whether, when, and how to disseminate intelligence was not clear, directly affecting the flow of information; and
  • The threat posed by political foreign interference activities was not clearly communicated by CSIS.

Finding 2: NSIRA found that CSIS’s dissemination and use of intelligence on political foreign interference was impacted by the concern that such actions could interfere, or be seen to interfere, in the democratic process.

Finding 3: NSIRA found that CSIS often elected to provide verbal briefings as opposed to written products in disseminating intelligence on political foreign interference during elections.

Finding 4: NSIRA found that there was a disconnect within CSIS between a region and National Headquarters as to whether reporting on political foreign interference was subject to higher thresholds of confidence, corroboration and contextualization for dissemination.

Part 2: The SITE Task Force and the CEIPP Panel

Finding 5: NSIRA found that the SITE Task Force and the CEIPP Panel were not adequately designed to address traditional, human-based foreign interference. Specifically:

  • The SITE Task Force focuses on threat activities during the election period, but traditional foreign interference also occurs between elections.
  • Global Affairs Canada’s representation on the SITE Task Force focused on online foreign interference activities.
  • The CEIPP Panel’s high threshold for a public announcement is unlikely to be triggered by traditional foreign interference, which typically targets specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

Finding 6: NSIRA found that the limited distribution of some CSIS and CSE intelligence to senior officials-only reduced the ability of the Royal Canadian Mounted Police, Global Affairs Canada, and the Privy Council Office to incorporate that intelligence into their analysis.

Finding 7: NSIRA found that CSIS and Public Safety did not have a system for tracking who received and read specific intelligence products, creating unacceptable gaps in accountability.

Finding 8: NSIRA found that the dissemination of intelligence on political foreign interference from 2018 to 2023 suffered from multiple issues. Specifically:

  • Intelligence consumers did not always understand the significance of the intelligence they received nor how to integrate it into their policy analysis and decision-making;
  • There was disagreement between intelligence units and senior public servants as to whether activities described in specific intelligence products constituted foreign interference or legitimate diplomatic activity.

Finding 9: NSIRA found that there was disagreement between senior public servants and the NSIA as to whether intelligence assessments should be shared with the political executive. Ultimately, the NSIA’s interventions resulted in two products not reaching the political executive, including the Prime Minister.

Finding 10: NSIRA found that the NSIA’s role in decisions regarding the dissemination of CSIS intelligence products is unclear.

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

Recommendation 1: NSIRA recommends that CSIS develop, in consultation with relevant government stakeholders, a comprehensive policy governing its engagement with threats related to political foreign interference. This policy should:

  • make explicit CSIS’s thresholds and practices for the communication and dissemination of intelligence regarding political foreign interference. This would include the relevant levels of confidence, corroboration, contextualization and characterization necessary for intelligence to be reported;
  • clearly articulate CSIS’s risk tolerance for taking action against threats of political foreign interference;
  • establish clear approval and notification processes (including external consultations) for all activities related to countering political foreign interference;
  • make clear any special requirements or procedures that would apply during election/writ periods, as necessary, including in particular procedures for the timely dissemination of intelligence about political foreign interference; and,
  • consider best practices from international partners (in particular the Five Eyes) regarding investigating and reporting about political foreign interference.

Part 2: The SITE Task Force and the CEIPP Panel

Recommendation 2: NSIRA recommends that the SITE Task Force align its priorities with the threat landscape, including threats which occur outside of the immediate election period.

Recommendation 3: NSIRA recommends that Global Affairs Canada (GAC) and the Privy Council Office ensure that GAC’s representation on the SITE Task Force leverages the department’s capacity to analyze and address traditional, human-based foreign interference, in addition to the online remit of the Rapid Response Mechanism Team.

Recommendation 4: NSIRA recommends that the Privy Council Office empower the CEIPP Panel to develop additional strategies to address the full threat landscape during election periods, including when threats manifest in specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

Recommendation 5: NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received intelligence products. In the case of highly sensitive and urgent intelligence, this should include documenting who has read intelligence products.

Recommendation 6: NSIRA recommends that Public Safety Canada, Global Affairs Canada, the Privy Council Office, and other regular consumers of intelligence, enhance intelligence literacy within their departments.

Recommendation 7: NSIRA recommends that the security and intelligence community develop a common, working understanding of political foreign interference.

Recommendation 8: NSIRA recommends that the role of the National Security and Intelligence Advisor to the Prime Minister, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Share this page
Date Modified:

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023: Notification Letter

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023


Notification Letter


Date of Publishing:

Letter to the Prime Minister

April 26, 2024

The Right Honourable Justin Trudeau, P.C., M.P.
Prime Minister of Canada
80 Wellington Street
Ottawa, ON K1A 0A2

Dear Prime Minister,

On behalf of the National Security and Intelligence Review Agency (NSIRA), it is my pleasure to present you with our special report on the Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023.

This review was conducted under the authority of paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act (NSIRA Act).

The review assessed the flow of information, within government, regarding political foreign interference activities carried out by the People’s Republic of China between 2018 and 2023, a period covering the last two federal general elections. Consistent with its mandate and the terms of reference, NSIRA reviewed, among other things: the dissemination practices of the Canadian Security Intelligence Service; the operation of key entities established by the government to protect the integrity of Canada’s elections; and the role of senior public servants, including the National Security and Intelligence Advisor to the Prime Minister, in the dissemination of intelligence. You received a classified version of this report on March 5, 2024.

From the outset of its review, while working independently from the National Security and Intelligence Committee of Parliamentarians (NSICOP), NSIRA helped ensure there was no unnecessary duplication of work between the two review bodies. On March 5, 2024, NSIRA notified NSICOP, as well as the Public Inquiry into Foreign Interference in Federal Electoral Processes and Democratic Institutions, that NSIRA’s classified report had been finalized and provided to you.

At that time, NSIRA further informed you that it was of the opinion that it was in the public interest to report on this matter and would therefore, pursuant to section 40 of the NSIRA Act, be submitting to you a special report to be tabled in Parliament. Over a period of six weeks, in accordance with paragraph 52(1)(b) of the NSIRA Act, NSIRA undertook the required consultations with the deputy heads of concerned agencies and departments to ensure that this special report does not contain information the disclosure of which would be injurious to national security, national defence, or international relations or information that is subject to solicitor-client privilege, the professional secrecy of advocates and notaries, or litigation privilege.

Recognizing the importance of this topic to Canadians, NSIRA made every effort to draft the report in a manner that would be largely releasable. NSIRA sought specific explanations for the redactions that were made and is satisfied that the presented version of the report is the most thorough version that can be released. The findings and recommendations in NSIRA’s classified report did not contain any injurious or privileged information. As such, the findings and recommendations of the special report are identical to those contained in the classified report. 

In line with obligations under the NSIRA Act, this report must be tabled in each House of Parliament within the first 15 days on which that House is sitting. NSIRA will not comment on the contents of its report until such time as this special report is tabled in Parliament, owing to parliamentary privilege.

This report contains 8 recommendations. We ask that the Government indicate to NSIRA whether it agrees with these recommendations and, if so, to explain how they will be implemented. The thorough and timely consideration of NSIRA’s recommendations is essential to ensuring that NSIRA’s efforts with regard to the accountability of government institutions yield results. If and when available, NSIRA may publish the Government’s responses to its recommendations alongside the version of this report on NSIRA’s website and may include them in an Annual Report.

Yours sincerely,

The Honourable Marie Deschamps, C.C.

Chair // National Security and Intelligence Review Agency

Share this page
Date Modified:

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023

Last Updated:

Status:

Published

Review Number:

23-07

Share this page
Date Modified:

Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022: Report

Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022


Report

Date of Publishing:

List of Acronyms

CBSA Canada Border Services Agency
CFIA Canadian Food Inspection Agency
CNSC Canadian Nuclear Safety Commission
CRA Canada Revenue Agency
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DND/CAF Department of National Defence/Canadian Armed Forces
FINTRAC Financial Transactions and Reports Analysis Centre of Canada
GAC Global Affairs Canada
GC Government of Canada
IRCC Immigration, Refugees and Citizenship Canada
NSIRA National Security and Intelligence Review Agency
PHAC Public Health Agency of Canada
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
SCIDA Security of Canada Information Disclosure Act
TC Transport Canada

Glossary of Terms

Contribution test The first part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (paragraph 5(1)(a)).
Proportionality test The second part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will not affect any person’s privacy interest more than reasonably necessary in the circumstances (paragraph 5(1)(b)).

Executive summary

This review provides an overview of the Security of Canada Information Disclosure Act (SCIDA)’s use in 2022. In doing so, it documents the volume and nature of information disclosures made under the SCIDA; assesses compliance with the SCIDA; and highlights patterns in the SCIDA’s use across Government of Canada (GC) institutions and over time.

In 2022, four disclosing institutions made a total of 173 disclosures to five recipient institutions. The National Security and Intelligence Review Agency (NSIRA) found that institutions complied with the SCIDA’s requirements for disclosure and record keeping in relation to the majority of these disclosures. Instances of non-compliance related to subsection 9(3), regarding the timeliness of records copied to NSIRA; subsection 5.1(1), regarding the timeliness of destruction or return of personal information; and subsection 5(2), regarding the provision of a statement on accuracy and reliability. The observed non-compliance did not point to any systemic failures in GC institutions’ implementation of the SCIDA.

NSIRA also made findings in relation to practices that, although compliant with the SCIDA, left room for improvement. These findings related to:

  • the use of information sharing arrangements;
  • the format of records prepared by institutions and copied to NSIRA, including the characteristics of effective records;
  • the nature of information provided under paragraph 9(1)(e) and relied upon in the conduct of assessments under subsection 5(1);
  • the provision of statements regarding accuracy and reliability prepared under subsection 5(2); and
  • the timeliness of administrative processes supporting information disclosure.

NSIRA made six recommendations designed to increase standardization across the GC in a manner that is consistent with institutions’ demonstrated best practices and the SCIDA’s guiding principles.

Overall, NSIRA observed improvements in reviewee performance as compared with findings from prior years’ reports and over the course of the review. These improvements include corrective actions taken by reviewees in response to NSIRA’s requests for information in support of this review.

1. Introduction

Authority

This review was conducted pursuant to paragraph 8(1)(b) and subsection 39(1) of the National Security and Intelligence Review Agency Act (NSIRA Act).

Scope of the Review

This review provides an overview of the Security of Canada Information Disclosure Act (SCIDA)’s use in 2022. In doing so, it:

  1. Documents the volume and nature of information disclosures made under the SCIDA;
  2. Assesses Government of Canada (GC) institutions’ compliance with the SCIDA’s requirements for record keeping;
  3. Assesses GC institutions’ compliance with the SCIDA’s requirements for disclosure, including the destruction or return of personal information, as appropriate; and
  4. Highlights patterns in the SCIDA’s use across GC institutions and over time.

The review’s scope was defined by records provided to NSIRA under the SCIDA, subsection 9(3) (see Annex A for a copy of institutions’ section 9 obligations under the Act). As such, the review’s assessment of compliance was limited to the seven GC institutions identified within these records as either disclosers or recipients (Canada Border Services Agency [CBSA], Communications Security Establishment [CSE], Canadian Security Intelligence Service [CSIS], Department of National Defence/Canadian Armed Forces [DND/CAF], Global Affairs Canada [GAC], Immigration, Refugees and Citizenship Canada [IRCC], and the Royal Canadian Mounted Police [RCMP]); and to instances of information disclosure where the SCIDA was identified by these institutions as an authority for disclosure. The review also included Public Safety Canada (PS) in its capacity as manager of the Strategic Coordination Centre on Information Sharing, which provides SCIDA-related policy guidance and training across the GC. 

The review satisfies the NSIRA Act’s section 39 requirement for NSIRA to report to the Minister of Public Safety on disclosures made under the SCIDA during the previous calendar year.

Methodology

The review’s primary source of information was records provided to NSIRA by disclosing and recipient institutions under the SCIDA, subsection 9(3). NSIRA also identified a targeted sample of disclosures for which it requested and assessed all associated documents provided by both the disclosing and recipient institution. This information was supplemented by a document review of institutions’ SCIDA policies and procedures, and related explanations.

NSIRA assessed administrative compliance with the SCIDA’s record-keeping obligations in relation to all disclosures identified in the records provided to NSIRA under subsection 9(3) (N=173). Where these records were incomplete, NSIRA provided an opportunity for institutions to supply the missing records. NSIRA accounted for such late submissions in its assessment of compliance with subsections 9(1) and 9(2).

NSIRA assessed substantive compliance with the SCIDA’s disclosure requirements in relation to the sample of disclosures (n=19). The sample was designed to reflect a non-representative cross-section of the SCIDA’s use, with particular attention to areas at higher risk of non-compliance. Disclosures were selected for the sample based on the content of records provided to NSIRA under subsection 9(3), according to defined parameters (see Annex B, Sample of Disclosures).

Review Statements

NSIRA found that, overall, its expectations for responsiveness by CSE, CSIS, DND/CAF, GAC, IRCC, PS, and RCMP during this review were met. Its expectations for responsiveness by CBSA were partially met, as CBSA required repeated follow-up to provide the requested information.

NSIRA was able to verify information for this review in a manner that met NSIRA’s expectations.

2. Backgrounder

The SCIDA provides an explicit, stand-alone authority to disclose information between GC institutions in order to protect Canada against activities that undermine its security. Its stated purpose is to encourage and facilitate such disclosures.

Section 9 of the SCIDA prescribes record-keeping obligations for all institutions who (1) disclose or (2) receive information under the Act. Each paragraph under subsections 9(1) and 9(2) identifies particular elements that must be set out in the records prepared and kept by each institution (see Annex A). Subsection 9(3) requires that these records be provided to NSIRA within 30 days after the end of each calendar year.

Subsection 5(1) of the SCIDA authorizes GC institutions to disclose information – subject to any prohibitions or restrictions in other legislation or regulations – to designated recipient institutions, if the disclosing institution is satisfied that (a) the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (the “contribution test”); and (b) the information will not affect any person’s privacy interest more than is reasonably necessary in the circumstances (the “proportionality test”).

Subsection 5(2) requires institutions that disclose information under subsection (1) to, at the time of the disclosure, also provide information regarding its accuracy and the reliability of the manner in which it was obtained.

When a GC institution receives information under the Act, subsection 5.1(1) requires that the institution destroy or return any unnecessary personal information as soon as feasible after receiving it.

The Act’s guiding principles underscore the importance of effectiveness and responsibility across disclosure activities. Of note, subsection 4(c) sets out that information sharing arrangements are appropriate in particular circumstances.

3. Findings, Analysis, and recommendations

Volume and Nature of Disclosures

In 2022, four disclosing institutions made a total of 173 disclosures to five recipient institutions (see Table 1). 79% (n=136) of these disclosures were requested by the recipient institution. The other 21% of disclosures (n=37) were sent proactively by the disclosing institution.

Table 1: Number of SCIDA disclosures made in 2022, by disclosing and recipient institution [all disclosures (proactive disclosures)]

    Designated Recipient Institutions
Disclosing Institution   CBSA CFIA CNSC CRA CSE CSIS DND/CAF Finance FINTRAC GAC Health IRCC PHAC PSC RCMP TC TOTAL (proactive)
CBSA 4
(3)
4
(3)
GAC 39
(18)
2
(2)
12
(12)
53
(32)
IRCC 59
(0)
56
(2)
115
(2)
RCMP 1
(0)
1
(0)
TOTAL (proactive) 59
(0)
95
(20)
2
(2)
1
(0)
16
(15)
173
(37)

The total number of disclosures made under the SCIDA since its implementation reflects a slight downward trend, with a generally constant proportion of requested versus proactive disclosures for the years in which this data was collected (see Figure 1).

Figure 1: Number of SCIDA disclosures over time

In 2022, these disclosures were made and received by institutions that had each disclosed or received information, as the case may be, in at least two prior review years (see Annex C, Overview of SCIDA Disclosures in Prior Years).

Finding 1: NSIRA found that CSE, CSIS, GAC, and IRCC regularly use the SCIDA in a manner that warrants information sharing arrangements, as encouraged by subsection 4(c) of the SCIDA.

CSE, CSIS, GAC, and IRCC were the most frequent users of the SCIDA in 2022. The number of disclosures between these institutions was comparable to those observed by NSIRA in prior years (see Annex C), indicating the occurrence of regular exchange over time.

NSIRA also observed regular patterns in the purpose and nature of the information exchanged between these institutions in 2022, as described in Table 2. These information exchanges were not governed by up-to-date information sharing arrangements.

Table 2: Nature of disclosures between the SCIDA’s most frequent users

GAC-to-CSIS (N=39) IRCC-to-CSIS (N=56) IRCC-to-CSE (N=59)
  • GAC information holdings relevant to threats to the security of Canada
  • Often (85%) made in direct response, or as a follow-up, to CSIS requests
  • IRCC information holdings relevant to threats to the security of Canada
  • Almost always (96%) made in response to CSIS requests
  • IRCC confirmation of Canadian status of named individuals of interest, required to ensure lawfulness of CSE operational activities
  • All (100%) made in response to CSE requests

NSIRA has previously recommended that information sharing arrangements be updated (for GAC and CSIS) or created (for IRCC and CSE) to govern certain information exchanges made under the SCIDA.

Recommendation 1: NSIRA recommends that information sharing arrangements be used to govern regular SCIDA disclosures between GAC and CSIS; IRCC and CSIS; as well as IRCC and CSE.

Record Keeping

Copy to NSIRA: Subsection 9(3)

Finding 2: NSIRA found that CBSA, DND/CAF, and IRCC were non-compliant with subsection 9(3) of the SCIDA, as they failed to provide all records created under subsections 9(1) or 9(2) to NSIRA within the legislated timeframe.

Requests for information from NSIRA during the course of this review prompted the late production of additional records relating to paragraphs under subsections 9(1) or 9(2) from each of CBSA, DND/CAF, and IRCC (see Table 3).

Table 3: Number [and associated subsection 9(1) or 9(2) paragraph] of late records leading to non-compliance with subsection 9(3), by cause

Administrative Error Delayed Preparation of Records
CBSA 2 [paragraph 9(1)(e)]
DND/CAF 2 [paragraphs 9(2)(e-g)]
IRCC 6 [paragraph 9(1)(e)] 1 [paragraphs 9(2)(e-g)]

CBSA and IRCC were non-compliant with subsection 9(3) due to administrative error; the records they eventually supplied had existed at the time of the reporting deadline, but were not copied to NSIRA as required.

NSIRA expected that all records would be prepared within 30 days after the end of the calendar year, in order to meet the subsection 9(3) requirement to provide a copy of those records to NSIRA within that timeframe.

DND/CAF and IRCC were non-compliant with subsection 9(3) on account of delayed preparation of records; they did not prepare the records referred to in Table 3 within 30 days after the end of the calendar year, and therefore did not provide a copy of them to NSIRA within the legislated timeframe.

NSIRA underscores the importance of administrative precision and timeliness in preparing records and copying them to NSIRA.

Format of Records

Finding 3: NSIRA found improved compliance outcomes in instances where departments prepared record overview spreadsheets under subsections 9(1) and 9(2) of the SCIDA that displayed the following characteristics:

  • a row for each disclosure made or received;
  • columns explicitly tied to each individual paragraph under section 9; and
  • additional columns to capture relevant administrative details, such as whether the disclosure was requested or proactive; the date of the request (if applicable); and any applicable file reference numbers.

The SCIDA does not specify a format for records prepared under section 9. Accordingly, in 2022, GC institutions fulfilled their record-keeping obligations in different ways.

Most institutions provided NSIRA with an overview of each disclosure made or received. These overviews were submitted to NSIRA as spreadsheets that generally captured the information required in records under subsections 9(1) and 9(2).

Most institutions also provided NSIRA with a copy of the disclosure itself and a selection of related documents. These documents often included email consultations with legal services, disclosure request letters, and other correspondence between disclosing and recipient institutions. The scope of requests for information in the course of the review was minimized in cases where institutions provided such documents.

DND/CAF and IRCC (for its one disclosure receipt) were the only institutions that originally provided NSIRA with a copy of the raw disclosure, including transmittal details, in the absence of a record overview or other related documents.

NSIRA observed that DND/CAF and IRCC’s choice in records format for these disclosures contributed to their non-compliance with subsection 9(3), described in Table 3. The information elicited under paragraphs 9(2)(e-g) cannot by definition be found within a copy of the disclosure itself, as it relates to action taken by recipient institutions following the disclosure’s receipt. A copy of the disclosure on its own is therefore insufficient to comply with all requirements under subsection 9(2).

Both DND/CAF and IRCC were infrequent recipients of disclosures under the SCIDA in 2022, accounting for only two and one disclosures, respectively. Each of the more frequent recipients of information (CSE, CSIS, and RCMP) included express columns in their record overview spreadsheets to capture whether and, if applicable, when personal information was destroyed or returned, per the requirements of paragraphs 9(2)(e-g).

NSIRA also observed that CBSA and IRCC’s choice in records format contributed to their non-compliance with subsection 9(3) due to administrative error. These institutions did not account for the full scope of information required under paragraph 9(1)(e) in their record overview spreadsheets.

The information relied upon to satisfy the disclosing institution that a disclosure is authorized under the Act is not required to be conveyed within the disclosure itself. Completing an appropriately-specified record overview spreadsheet is therefore an effective way to ensure that the corresponding information is documented and conveyed to NSIRA ahead of the legislated deadline.

The RCMP’s record overview spreadsheet was particularly effective in demonstrating compliance with the Act. The spreadsheet included columns that were explicitly tied to individual paragraphs under section 9, with additional fields limited to RCMP administrative information such as file and database reference numbers.

Spreadsheets designed in this way enable institutions’ efficient self-assessment against the requirements of the Act. They also facilitate the task of review by clearly matching the information provided with its corresponding requirement under the SCIDA, and by organizing disclosures and receipts of information in a manner that supports cross-verification.

Recommendation 2: NSIRA recommends that all GC institutions prepare record overviews to clearly address the requirements of subsections 9(1) and 9(2) of the SCIDA; and provide them to NSIRA along with a copy of the disclosure itself and, where relevant, a copy of the request.

Preparing and Keeping Records: Subsections 9(1) and 9(2)

Finding 4: NSIRA found that all GC institutions complied with their obligation to prepare and keep records that set out the information prescribed under subsections 9(1) and 9(2) of the SCIDA.

Finding 5: NSIRA found that more than half of the descriptions provided by CBSA and IRCC under paragraph 9(1)(e) of the SCIDA did not explicitly address their satisfaction that the disclosure was authorized under paragraph 5(1)(b), the proportionality test.

Although NSIRA expected an express statement describing the information that was relied on to satisfy the disclosing institution that the disclosure was authorized under the SCIDA, in this review, NSIRA considered any records that demonstrated the corresponding assessment had been conducted.

IRCC n’a pas fait de déclaration expresse précisant que les communications demandées par le SCRS, qui représentent 57 % (n=54) de l’ensemble de ses communications, lui semblaient satisfaisantes du point de vue du critère de proportionnalité. En revanche, IRCC a fourni des copies des lettres de demande et de l’information communiquée en guise de réponse, ce qui confirme que la communication était manifestement conforme aux besoins précis de la demande (et donc témoigne d’une évaluation de la proportionnalité).

L’ASFC n’a pas fourni de déclaration expresse concernant sa satisfaction au regard du critère de proportionnalité pour 75 % (n=3) de ses communications. Elle a plutôt démontré qu’elle tenait compte du principe de proportionnalité en fournissant divers documents justificatifs, y compris de la correspondance interne.

La feuille de calcul utilisée par AMC pour donner une vue d’ensemble de ses documents a été particulièrement efficace pour répondre aux exigences de l’alinéa 9(1)e). L’analyse détaillée qu’elle a consignée en ce qui concerne les critères de contribution et de proportionnalité lui a permis de remplir ses obligations en matière de conservation des dossiers et de démontrer qu’elle respectait en substance le paragraphe 5(1).

Recommendation 3: NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.

Disclosure of Information

Contribution and Proportionality Tests: Paragraphs 5(1)(a) and 5(1)(b)

Finding 6: NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves of both the contribution and proportionality tests, in compliance with subsection 5(1) of the SCIDA.

Finding 7: NSIRA found that GAC satisfied itself under the SCIDA’s paragraph 5(1)(a) contribution test based on an incorrect understanding of the recipient’s national security mandate in two cases.

The threshold for compliance with subsection 5(1) is that the disclosing institution has satisfied itself of the contribution and proportionality tests, and that it has done so prior to having made the disclosure.

In relation to the two disclosures that it made proactively to DND/CAF, GAC provided a rationale for the information’s contribution to DND/CAF’s mandate in respect of national security. Upon receipt of the information, however, DND/CAF did not agree with GAC’s assessment and therefore assessed that the SCIDA was not an appropriate disclosure mechanism in the circumstances.

Informal communication between the two institutions may have allowed DND/CAF and GAC to resolve this issue prior to the disclosure. When such communications occur, it is important that they be limited to the information necessary to confirm that the information contributes to the recipient’s mandate in respect of activities that undermine the security of Canada.

Recommendation 4: NSIRA recommends that GC institutions contemplating the use of proactive disclosures under the SCIDA communicate with the recipient institution, ahead of making the disclosure, to inform their assessments under subsection 5(1).

Statement Regarding Accuracy and Reliability: Subsection 5(2)

Finding 8: NSIRA found, within the sample of disclosures reviewed, that CBSA and GAC (in one and two disclosures, respectively) were non-compliant with the SCIDA’s subsection 5(2) requirement to provide a statement regarding accuracy and reliability.

Finding 9: NSIRA found, in relation to the remaining disclosures within the sample, that GAC, IRCC, and RCMP included their statements regarding accuracy and reliability within the disclosures themselves, whereas CBSA provided its statements in the disclosures’ cover letters.

Providing the statement on accuracy and reliability in a cover letter for the disclosure satisfies the Act’s requirement to provide the statement at the time of disclosure. However, separating the statement from the information disclosed increases the risk that the information may be subsequently used without awareness of relevant qualifiers. The location of the statement on accuracy and reliability – and not just its contemporaneous provision to the recipient – is therefore relevant to its value added.

Recommendation 5: NSIRA recommends that all disclosing institutions include statements regarding accuracy and reliability within the same document as the disclosed information.

Requirement to Destroy or Return Personal Information: Subsection 5.1(1)

Finding 10: NSIRA found that DND/CAF destroyed information under the SCIDA subsection 5.1(1), but they were non-compliant with the requirement to do so “as soon as feasible after receiving it.”

DND/CAF determined, upon receipt of the two disclosures it received from GAC, that the personal information contained within the disclosures should not be retained. The information, however, was not destroyed until April 2023 – 12 days following a request for information from NSIRA to provide a copy of records that set out whether and when the information had been destroyed or returned. The date of destruction was 299 and 336 days following DND/CAF’s receipt of each disclosure.

Taking into consideration the elapsed time between receipt of the information and its destruction, as well as DND/CAF’s timely conclusion that the information should not be retained, DND/CAF’s ultimate destruction of the information was non-compliant with the requirement to destroy the information “as soon as feasible after receiving it.” Its delay in this respect was also inconsistent with the responsible use and management of the information.

DND/CAF was the only institution to identify any disclosures as containing information that was destroyed or returned under subsection 5.1(1) in 2022. NSIRA did not identify any other disclosures within the sample for which personal information disclosed should have been destroyed or returned.

Purpose and Principles: Effective and responsible disclosure of information

Finding 11: NSIRA found delays between when a disclosure was authorized for sending and when it was received by the individual designated by the head of the recipient institution to receive it in at least 20% (n=34) of disclosures.

These 34 disclosures include 29 for which there was a delay between the dates provided by disclosing and recipient institutions in their section 9 records, as well as an additional five for which CSIS reported both the date of administrative receipt within the institution and the subsequent date of receipt by the person designated by the head to receive it (i.e., the relevant operational unit).

NSIRA attributes most of these delays to expected dynamics in classified information sharing: the individual authorizing the disclosure is not always the same individual who administratively sends it to the recipient, and the person who administratively receives the disclosure is not always the same person who is designated by the head to receive it.

In the majority of cases, the observed delays were shorter than one week. In nine cases, however, the delay ranged from 30 to 233 days.

Such delays mean that information is not processed and actioned within the recipient institution until long after it was sent – or intended to be sent – by the individual authorizing the disclosure. While these delays do not amount to non-compliance with the SCIDA, they are inconsistent with the Act’s purpose and guiding principles.

Recommendation 6: NSIRA recommends that GC institutions review their administrative processes for sending and receiving disclosures under the SCIDA, and correct practices that cause delays.

4. Conclusion

The SCIDA’s requirements for disclosure and record keeping apply to both disclosing and recipient institutions in all cases where the SCIDA is invoked as a mechanism for disclosure. This review assessed GC institutions’ compliance with requirements for record keeping in respect of all 173 disclosures that were made and received in 2022. It assessed their compliance with requirements for disclosure in relation to a targeted sample of 19 disclosures.

NSIRA found that institutions complied with the SCIDA’s requirements for disclosure and record keeping in relation to the majority of disclosures. GC institutions’ non-compliance with subsection 9(3) was driven by irregularities in the reporting of 11 disclosures. Observed non-compliance with substantive requirements under subsection 5(2) related to three disclosures; and non-compliance with subsection 5.1(1) related to two disclosures. These instances of non-compliance do not point to any systemic failures in GC institutions’ implementation of the SCIDA.

Within this context, NSIRA observed improvements in reviewee performance as compared with findings from prior years’ reports and over the course of the review. Of note, NSIRA’s requests for information in support of this review prompted corrective action by CBSA, DND/CAF, and IRCC that would have otherwise amounted to non-compliance with requirements under section 9.

NSIRA also observed several practices that, although compliant with the SCIDA, leave room for improvement. NSIRA’s recommendations in this review are designed to increase standardization across the GC in a manner that is consistent with institutions’ demonstrated best practices and the SCIDA’s guiding principles.

Annex A. Record Keeping Obligations for Disclosing and Recipient Institutions

Obligation – disclosing institution Obligation — recipient institution 
9 (1) Every Government of Canada institution that discloses information under this Act must prepare and keep records that set out (2) Every Government of Canada institution that receives information under this Act must prepare and keep records that set out
(a) a description of the information; (a) a description of the information;
(b) the name of the individual who authorized its disclosure; (b) the name of the institution that disclosed it;
(c) the name of the recipient Government of Canada institution; (c) the name or position of the head of the recipient institution — or of the person designated by the head — who received the information;
(d) the date on which it was disclosed; (d) the date on which it was received by the recipient institution;
(e) a description of the information that was relied on to satisfy the disclosing institution that the disclosure was authorized under this Act; and (e) whether the information has been destroyed or returned under subsection 5.1(1);
(f) if the information has been destroyed under subsection 5.1(1), the date on which it was destroyed;
(g) if the information was returned under subsection 5.1(1) to the institution that disclosed it, the date on which it was returned; and
(f) any other information specified by the regulations. (h) any other information specified by the regulations.

Copy to National Security and Intelligence Review Agency

Within 30 days after the end of each calendar year, every Government of Canada institution that disclosed information under section 5 during the year and every Government of Canada institution that received such information must provide the National Security and Intelligence Review Agency with a copy of every record it prepared under subsection (1) or (2), as the case may be, with respect to the information.

Annex B. Sample of Disclosures

Disclosures were selected for the sample based on the content of records provided to NSIRA under subsection 9(3), according to the following parameters:

  • At least two disclosures per discloser-recipient pair, if available;
  • At least one proactive disclosure per discloser, if available;
  • At least one requested disclosure per recipient, if available;
  • All disclosures identified by recipient institutions as including personal information that was destroyed or returned under the SCIDA, subsection 5.1(1);
  • All disclosures for which there is a high-level discrepancy in the discloser and recipient records (i.e., a record of receipt, but no record of disclosure; a substantive misalignment in the description of the information; greater than seven days’ discrepancy in the date sent and received; date of receipt earlier than the date of sending);
  • All disclosures made by an institution that is not listed in Schedule 3 of the SCIDA; and
  • All disclosures received by institutions added to Schedule 3 in the preceding year.

Annex C. Overview of SCIDA Disclosures in Prior Years

Drawing on information published in previous NSIRA reports, Table 5 summarizes the number and distribution of disclosures made under the SCIDA in prior years.

Table 5: Number of SCIDA disclosures, by disclosing and recipient institution, 2019-2021

    Designated Recipient Institutions
  Disclosing Institution CBSA CFIA CNSC CRA CSE CSIS DND/CAF Finance FINTRAC GAC Health IRCC PHAC PSC RCMP TC TOTAL (proactive)
2021 DND/CAF 2 2
GAC 41 1 2 44
IRCC 68 79 2 149
TOTAL 68 122 2 1 2 195
2020 CBSA 1 3 4
GAC 1 25 1 13 40
IRCC 60 61 37 1 159
RCMP 1 3 5 9
TC 2 2
Other 1 1
TOTAL 61 88 1 3 6 55 1 215
2019 CBSA 1 2 3
GAC 23 3 1 15 42
IRCC 5 17 1 36 59
RCMP 4 1 3 1 9
TC 1 1
TOTAL 4 5 41 1 1 3 4 1 54 114

Annex D. Findings and Recommendations

Findings

NSIRA found that CSE, CSIS, GAC, and IRCC regularly use the SCIDA in a manner that warrants information sharing arrangements, as encouraged by subsection 4(c) of the SCIDA.

NSIRA found that CBSA, DND/CAF, and IRCC were non-compliant with subsection 9(3) of the SCIDA, as they failed to provide all records created under subsections 9(1) or 9(2) to NSIRA within the legislated timeframe.

NSIRA found improved compliance outcomes in instances where departments prepared record overview spreadsheets under subsections 9(1) and 9(2) of the SCIDA that displayed the following characteristics:

  • a row for each disclosure made or received;
  • columns explicitly tied to each individual paragraph under section 9; and
  • additional columns to capture relevant administrative details, such as whether the disclosure was requested or proactive; the date of the request (if applicable); and any applicable file reference numbers.

NSIRA found that all GC institutions complied with their obligation to prepare and keep records that set out the information prescribed under subsections 9(1) and 9(2) of the SCIDA.

NSIRA found that more than half of the descriptions provided by CBSA and IRCC under paragraph 9(1)(e) of the SCIDA did not explicitly address their satisfaction that the disclosure was authorized under paragraph 5(1)(b), the proportionality test.

NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves of both the contribution and proportionality tests, in compliance with subsection 5(1) of the SCIDA.

NSIRA found that GAC satisfied itself under the SCIDA’s paragraph 5(1)(a) contribution test based on an incorrect understanding of the recipient’s national security mandate in two cases.

NSIRA found, within the sample of disclosures reviewed, that CBSA and GAC (in one and two disclosures, respectively) were non-compliant with the SCIDA’s subsection 5(2) requirement to provide a statement regarding accuracy and reliability.

NSIRA found, in relation to the remaining disclosures within the sample, that GAC, IRCC, and RCMP included their statements regarding accuracy and reliability within the disclosures themselves, whereas CBSA provided its statements in the disclosures’ cover letters.

NSIRA found that DND/CAF destroyed information under the SCIDA subsection 5.1(1), but they were non-compliant with the requirement to do so “as soon as feasible after receiving it.”

NSIRA found delays between when a disclosure was authorized for sending and when it was received by the individual designated by the head of the recipient institution to receive it in at least 20% (n=34) of disclosures.

Recommendations

  1. NSIRA recommends that information sharing arrangements be used to govern regular SCIDA disclosures between GAC and CSIS; IRCC and CSIS; as well as IRCC and CSE.
  2. NSIRA recommends that all GC institutions prepare record overviews to clearly address the requirements of subsections 9(1) and 9(2) of the SCIDA; and provide them to NSIRA along with a copy of the disclosure itself and, where relevant, a copy of the request.
  3. NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.
  4. NSIRA recommends that GC institutions contemplating the use of proactive disclosures under the SCIDA communicate with the recipient institution, ahead of making the disclosure, to inform their assessments under subsection 5(1).
  5. NSIRA recommends that all disclosing institutions include statements regarding accuracy and reliability within the same document as the disclosed information.
  6. NSIRA recommends that GC institutions review their administrative processes for sending and receiving disclosures under the SCIDA, and correct practices that cause delays.
Share this page
Date Modified:

Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022

Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2022


Last Updated:

Status:

Published

Review Number:

23-03

Share this page
Date Modified:

Review of Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2020: Report

Review of Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2020


Report

Date of Publishing:

Executive Summary

The Avoiding Complicity in Mistreatment by Foreign Entities Act (ACA or Act) and its associated directions seek to prevent the mistreatment of any individual as a result of information exchanged between a Government of Canada department and a foreign entity. At the heart of the directions is the consideration of substantial risk, and whether that risk, if present, can be mitigated. To do this, the Act and the directions lay out a series of requirements that need to be met or implemented when handling information. This review covers the implementation of the directions sent to 12 departments and agencies from their date of issuance, January 1, 2020, to the end of the previous calendar year, December 31, 2020. It was conducted under subsection 8(2.2) of the National Security and Intelligence Review Agency Act (NSIRA Act), which requires NSIRA to review, each calendar year, the implementation of all directions issued under ACA.

This was the first ACA review to cover a full calendar year. Many of the reviewed departments noted that the pandemic impacted their information sharing activities, thus impacting the number of cases requiring further review as per the ACA. As such, NISIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.

While NSIRA was pleased with the considerable efforts made by many departments new to ACA in building their frameworks, Canada Boarder Services Agency (CBSA) and Public Safety did not finalize their policy frameworks in support of the Directions received under the ACA for the review period.

As part of the review, NSIRA examined the case triage process of all twelve departments. NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.

A case sent to both GAC and CSIS was reviewed by NSIRA for its implications under the ACA. While the information was ultimately not shared with the requesting foreign entity, nonetheless, NSIRA found that the risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.

Mitigation measures used by departments were also reviewed this year, since they are an integral part in the information sharing process for departments. NSIRA observed that there are gaps in departments’ ability to verify whether a country or entity has actually complied with caveats or assurances because of the difficulty in tracking compliance to mitigation measures.

NSIRA believes that it is now in a position to conduct in-depth case study assessments of individual departments’ adherence to the ACA and Directions, irrespective of whether or not a department reported any cases to its deputy head. Finally, future reviews will follow up on the ongoing implementation of NSIRA’s past recommendations.

In keeping with NSIRA’s 2020 Annual Report which emphasized the implementation of a “trust but verify” approach for assessing information provided over the course of a review, NSIRA continues to work on various verification strategies with the Canadian intelligence community. However, due to the continuing COVID-19 pandemic, implementation of verification processes was not possible across all twelve departments which fall under the ACA. Notwithstanding, the information provided by departments has been independently verified by NSIRA through documentation analysis and meetings with department subject matter experts, as warranted. Further work is underway to continue developing an access model for the independent verification of information relevant to ACA considerations.

Authorities

This review was conducted under subsection 8(2.2) of the NSIRA Act, which requires NSIRA to review, each calendar year, the implementation of all directions issued under the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACA or the Act).

Introduction

Review background

Departments and agencies in the Government of Canada routinely share information with a range of foreign entities. However such practices can sometimes bring into play a risk of mistreatment for individuals who are the subjects of these exchanges or other individuals. It is therefore incumbent upon the Government of Canada to evaluate and mitigate the risks that this sharing entails.

In 2011, the Government of Canada implemented a general framework for Addressing Risks of Mistreatment in Sharing Information with Foreign Entities. The aim of the framework was to establish a coherent approach across government when sharing with and receiving information from foreign entities. Following this, Ministerial Direction was issued to applicable departments in 2011 (Information Sharing with Foreign Entities), and then again in 2017 (Avoiding Complicity in Mistreatment by Foreign Entities).

On July 13, 2019, the ACA came into force. The preamble of the Act recognizes Canada’s commitments with respect to the Canadian Charter of Rights and Freedoms, and Canada’s international legal obligations on prohibiting torture and other cruel and inhumane treatment. The Act also recognizes that information needs to be shared to enable the Government to fulfill its fundamental responsibility to protect Canada’s national security and the safety of Canadians.

On September 4, 2019, pursuant to section 3 of the ACA, the Governor in Council (GiC) issued written directions (Orders in Council (OiCs) or Directions) to the deputy heads of 12 departments and agencies. This added six new Canadian entities in addition to those that were already associated with the 2011 and 2017 Directions.

This report is NSIRA’s first full year assessment of the implementation of the Directions issued under ACA for the 2020 calendar year. The review builds upon two previous reviews conducted in respect of avoiding complicity in mistreatment. The first was in respect to the 2017 Ministerial Directions, while the second assessed the Directions issued under the ACA, but was limited to the four months from when the Directions were issued to the end of the 2019 calendar year.

ACA and Directions

The ACA and the Directions issued under its authority seek to prevent the mistreatment of any individual due to the exchange of information between a Government of Canada department or agency and a foreign entity. The Act and the Directions also aim to limit the use of information received from a foreign entity that is likely to have been obtained through the mistreatment of an individual.

Under the authority of subsection 3(1) of the Act, the Directions issued to the 12 departments and agencies are near identical in language and focus on the three aspects of handling information when interacting with a foreign entity: the disclosure of information, the requesting of information, and the use of any information received.

In regards to disclosure of information, the Directions state:

If the disclosure of information to a foreign entity would result in a substantial risk of mistreatment of an individual, the Deputy Head must ensure that the Department officials do not disclose the information unless the officials determine that the risk can be mitigated, such as through the use of caveats or assurances, and appropriate measures are taken to mitigate the risk.

With respect to requesting information, the Directions read as follows:

If the making of a request to a foreign entity for information would result in a substantial risk of mistreatment of an individual, the Deputy Head must ensure that Department officials do not make the request for information unless the officials determine that the risk can be mitigated, such as through the use of caveats or assurances, and appropriate measures are taken to mitigate the risk.

Lastly, as it relates to the use of information, the Directions provide:

The Deputy Head must ensure that information that is likely to have been obtained through the mistreatment of an individual by a foreign entity is not used by the Department
(a) in any way that creates a substantial risk of further mistreatment;
(b) as evidence in any judicial, administrative or other proceeding; or
(c) in any way that deprives someone of their rights or freedoms, unless the Deputy Head or, in exceptional circumstances, a senior official designated by the Deputy Head determines that the use of the information is necessary to prevent loss of life or significant personal injury and authorizes the use accordingly.

The consideration of substantial risk figures prominently in subsection 3(1) of the Act as well as the Directions. In considering whether to disclose or request information, a department must determine whether a substantial risk is present and if so whether it can be mitigated. As noted in the previous reviews on information sharing, the ACA does not define “substantial risk”. Departments refer to a definition of this term as set out in the 2017 Ministerial Directions as a general starting point when conducting assessments under the ACA. The 2017 Ministerial Directions define substantial risk as:

‘Substantial risk’ is a personal, present and foreseeable risk of mistreatment that is real and is based on something more than mere theory or speculation. In most cases, the test of a substantial risk of mistreatment would be satisfied when it is more likely than not there would be mistreatment; however, in some cases, particularly where the risk if of severe harm, the standard of substantial risk may be satisfied at a lower level of probability.

Based on the outcome of these determinations, the decision may be to approve, deny, or elevate to the Deputy Head for his or her consideration. Substantial risk is also contemplated in the consideration of the use of information received from a foreign entity. If it is evaluated that the information was likely obtained from the mistreatment of an individual, the department is prohibited from using the information in any way that creates a substantial risk of further mistreatment.

Throughout the process to determine whether to disclose or use information, the Directions require that the accuracy, reliability, and limitations of use of all information being handled are appropriately described and characterized.

Additionally, reporting requirements are found at sections 7 and 8 of the Act as well as within the Directions. Among these requirements, the Minister responsible for the department must provide a copy of the department’s annual report in respect of the implementation of the Directions during the previous calendar year as soon as feasible to NSIRA, the National Security and Intelligence Committee of Parliamentarians (NSICoP) and, if applicable, the Civilian Review and Complaints Commission (CRCC) for the Royal Canadian Mounted Police. Reporting requirements as articulated in the Directions oblige the reporting of decisions which were considered by the Deputy Head in regards to disclosure, requesting of information, or authorizing use of information that would deprive someone of their rights or freedoms be made as soon as feasible to the responsible Minister, NSIRA, and NSICoP.

Review Objectives and Methodology

The review period was January 1, 2020 to December 31, 2020. The objectives of this review included:

  • Following-up on departments’ implementation of the directives received under the ACA;
  • Assessing departments’ operationalization of frameworks/processes that enable them to meet the obligations set out in the ACA and directives; and
  • Assessing coordination and consistency in implementation across applicable departments.

Additionally, NSIRA evaluated all twelve ACA member departments’ ‘case triage’ frameworks (i.e., the combination of policy assessment criteria and a pre-determined ‘escalation ladder’ for cases that require higher levels of managerial approvals). Refer to annexes B to M that provide additional details on each departments’ triage process. Finally, NSIRA reviewed the use and policies around departmental mitigation measures.

FINDINGS

Reporting and Framework Updates

As per the Act, all twelve departments fulfilled their obligations to report to their respective ministers and NSIRA on progress made in operationalizing frameworks and identifying cases escalated to the deputy head level.

Of the nine departments who had reported to NSIRA last year that they had finalized frameworks, all continued to refine assessment protocols over the 2020 review period. Based on submissions to NSIRA, TC has developed a corporate policy to highlight the department’s ACA-related requirements. However, CBSA and PS had yet to finalize their ACA policy. As a result, employees may not have adequate and up to date guidance on how to make determinations related to the ACA.

NSIRA Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.

Referrals to Deputy Head

The Directions specify that when departmental officials are unable to determine whether the risk of mistreatment arising from a disclosure of or request for information can be mitigated, the matter must be referred to the Deputy Head. The Directions also require the Deputy Head, or in exceptional circumstances a senior official designated by the Deputy Head, to determine the matter where the use of information that is likely to have been obtained through mistreatment of an individual by a foreign entity would in any way deprive an individual of their rights or freedoms and the use of this information is necessary to prevent loss of life or significant injury. In 2020, no cases were escalated to the deputy head level. NSIRA sought clarification on the absence of cases referred; the most common reason provided by departments for this outcome was that cases were either mitigated before deputy head involvement and/or this was a result of an overall reduction in the number of foreign information exchanges generally due to the ongoing pandemic.

NSIRA Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.

Case Triage

Typically, when departments are making ACA applicability decisions, they employ varying “case triage” processes, that is, the combination of policy assessment criteria and a pre-determined ‘escalation ladder’ for cases that require higher levels of managerial assessment. NSIRA closely evaluated all twelve ‘case triage’ frameworks of the departments subject to the ACA (Refer to Annex B-M). In carrying out this work, NSIRA noted some issues in the implementation of triage systems; for example, there were instances of not having one designed and of information being outdated.

NSIRA observed that there were two main types of initial case triage processes: case-by-case, where the framework places the onus on the working level official to first make determinations based on policy assessment tools, relevant training, and individual experience; and country assessment rating, which emphasizes the initial use of a country-based risk level that may trigger case escalation. A country assessment rating is a representation of the assessed risk of mistreatment associated to a country, based on a number of criteria and often derived from a range of sources.

Initial Case Triage Category 1: Case-by-Case

All departments use working level officials to determine whether there is a risk of mistreatment. When a working level officials’ assessment is inconclusive as to whether a substantial risk of mistreatment exists, they will defer the decision to a higher management authority. NSIRA has developed Figure 1 to illustrate this type of triage process where the working level official consults assessment tools at his or her disposal to determine whether a substantial risk of mistreatment exists.

Figure 1: Case by Case Triage Diagram

Initial Case Triage Category 2: Informed by Country Assessment Rating

CSIS, CSE, FINTRAC, and RCMP require working level officials to use country assessment ratings that may trigger case escalation. For example, NSIRA has developed Figure 2 to illustrate this type of triage process where country assessment ratings may trigger case escalation.

Case Escalation

In addition to the two categories of case triage frameworks identified above, all departments except for FINTRAC, PS, CSE and TC make use of internal consultation groups/senior decision making committees when cases are identified as requiring consultation/escalation (e.g. working groups and senior management committee secretariats). The following table illustrates the various consultation groups across departments that would make determinations related to the ACA.

The general purpose of consultation groups is to serve as a single point of contact for employees who require assistance in assessing foreign information sharing activities or interpreting policy and procedure. Senior decision making committees are responsible for making determinations on the information exchange. They are the final decision making authority prior to escalation to the deputy head. NSIRA observed that leveraging the overall expertise of these groups may assist officials in consistently applying assessment criteria, as well as provide greater oversight for information exchanges with foreign entities.

Consistency in Implementation Across Departments

Beginning with the 2017 Ministerial Directions on Avoiding Complicity in Mistreatment by Foreign Entities, it was required that departments maintain policies and procedures to assess the risks of information sharing relationships with foreign entities. While not specified in the Act or Directions, departments continue to implement country and entity assessments, a practice NSIRA has supported. NSIRA has previously raised concerns regarding the absence of unified and standardized approach to departments’ country assessments. The PCO-led community response to last year’s recommendation on this element stated in part that:

The information sharing activities of these organizations all serve either an intelligence, law enforcement, or administrative purpose with each carrying different risk profiles, privacy concerns, and legal authorities. Individual departments and agencies are responsible for establishing specific thresholds or triggers in their information sharing frameworks that are appropriate for their operational contexts. It is the view of the Government of Canada that applying the same threshold across all organizations for triggering, evaluating, and elevating cases is not necessarily practical nor essential to ensuring that each department or agency is operating in compliance with the Act.

In order to engage in the questions to which the divergence of thresholds gives rise, NSIRA asked departments to rank bi-lateral information exchanges with foreign partners in terms of volume, excluding exchanges with [***example of foreign entity information sharing***]. Nine of the twelve departments identified ███████ as a foreign exchange entity, a country which is widely recognized as having human rights concerns.

NSIRA then selected only those departments that initially utilize country assessment ratings as a triage method (i.e. FINTRAC, RCMP, CSIS and CSE). [***description of how departments determined foreign entity example***]. Nonetheless, in carrying out this analysis, NSIRA observed that all four departments relied on a combination of open source human rights reports and consultations with other departments. Additionally, RCMP, CSIS and CSE utilize classified intelligence sources.

However, although these departments utilize a similar approach when assessing a country, the assigned rating for ████ was not consistent. CSIS assigned █████████████; FINTRAC and RCMP assigned a [***description of department’s specific ratings***] ; and finally, CSE assigned a ██████ rating.

NISRA examined to what degree country ratings affected the level of approval required for an information exchange. Because CSE has assigned a rating of █████ when they receive a request from ████, a CSE official could require [***description of the factors used to determine the appropriate level process***] CSE acknowledged that its “human rights assessments do not necessarily correlate with the risk level assigned to an instance of sharing,” and nor do they “necessarily correlate to levels of approval or to restrictions to sharing.” [***description of the factors used to determine the appropriate level process***]

In contrast, according to their framework and methodology, an exchange with any one of the █████ authorities listed in the RCMP’s country and entity assessment list could result in an [***description of department’s specific ratings***] because █████ is associated with a country assessment rating. When an entity is yellow, the employee must consider whether or not there is a risk of mistreatment by looking at a list of criteria. If one or more of these criteria exist, the employee must send the case to a senior management committee. NSIRA observes that where the RCMP has a red country rating, the working level official must escalate to the senior management committee. Therefore, unlike CSE and CSIS, country ratings within the RCMP have direct impacts on approval levels.

NSIRA’s ACA report from last year recommended that departments should identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach when interacting with Foreign Entities of concern. While PCO disagreed with this recommendation, NSIRA believes that there remain concerns regarding divergences in country and risk assessments.

NSIRA Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be scalated, significant divergences in the evaluation of risk and the required level of approval emerge.

Following this review, NSIRA intends to further scrutinize the processes employed regarding ACA triage and decision making by reviewing GAC and RCMP.

A case study as provided for in Box 1 exemplifies the divergent nature on the evaluation of risk where two departments’ considered responding to an identical request made by a foreign entity.

Box 1: A divergent decision-making process

[***description of the case study***] The foreign entity provided this information to GAC and CSIS and requested confirmation [***description of the information sharing request***]

In considering whether to respond to this request, GAC determined that the human rights record of the country in question generally and of the foreign entity specifically making the request were of significant concern. GAC’s senior decision making committee, working under the presumption that the individual’s detention was ongoing, considered whether the disclosure of this information “would not substantially increase the detainee’s risk of mistreatment.” The senior decision making committee determined that confirmation of the individual’s previous employment status with GAC was permissible, subject to the determination of CSIS’s assessment.

Ultimately, the decision by CSIS was made by a DG-level executive and, as the foreign entity was listed by CSIS as a restricted partner, information was not shared.

The assessment by GAC’s senior decision-making committee is of concern. The Act and the Directions impose that departments consider whether disclosing or requesting information “would result in a substantial risk of mistreatment.” [***legal advice to department***]

NSIRA agrees with this interpretation of the law, but not with its implementation by GAC in this case. GAC’s position was that responding to the request “would not aggravate” the risk of mistreatment. However, NSIRA is of a different view. Regardless of the information sought, the human rights record of the foreign entity and of the foreign country was of significant concern, and GAC was operating under the presumption that the individual may have already been subjected to mistreatment. While GAC’s sharing could not have accounted for any mistreatment that could have occurred earlier, responding to the request given the facts of this case would have nonetheless resulted in a substantial risk of mistreatment. Therefore, this case should have been refered to the Deputy Minister of Foreign Affairs for consideration.

NSIRA also observes that this case was triaged at different levels within GAC and CSIS. In GAC’s triage process, the decision was made at the higher senior decision-making committee that disclosure was permissible. Comparatively, CSIS’s decision-making process was completed prior to reaching their senior-level committee and yielded the opposite result. The different levels of decision-making and different outcomes underscore a problematic inconsistency in how each organization considers the same information to be disclosed to the same foreign entity. Furthermore, while a department responsible for the information may consult with other departments as to whether disclosure of information is permissible, it cannot abdicate this responsibility and decision-making to another department.

NSIRA Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.

Mitigation Measures

Use of Mitigation Measures

To decrease the risk of mistreatment, departments will employ mitigation measures such as caveats, assurances, sanitization, and redactions. The most common mitigation measures are caveats and assurances. Caveats are specific stipulations appended to information to limit or prohibit certain uses of information unless otherwise authorized by the issuing department. For example, any departments use a ‘third party’ caveat that restricts further dissemination of the information to other departments (domestic and foreign), unless the originating department is consulted on the request to share.

Assurances are not specific to a single information exchange; rather, these are agreements with foreign entities (whether formal or informal), which aim to help ensure that a particular foreign entity understands Canada’s position on human rights and that the entity, in turn, agrees to comply with this expected behaviour. For example, when formulating a risk mitigation strategy for an information exchange, departments will consider written or verbal assurances, who provided the assurance (i.e. working level official or agency head), and whether the assurance is considered credible and reliable.

Furthermore, CSIS, CSE, and GAC have highlighted a number of differences in the types of assurances sought, including a number of informal and formal methods. For example, verbal assurances, scheduled formal assurances, and ad-hoc written assurances can be sought by various levels.

In a related issue, NSIRA observed that there are [***description and an example of a Department’s ability to track compliance***] CSIS, GAC, and CSE indicated that there is ████████████████████████████████████████████████████████████ is not specific to the ACA but is nonetheless key ████████████ when exchanging information with the Government of Canada.

Given that no cases were escalated to the level of deputy head, departments’ lower-level use of mitigation strategies would have taken on considerable prominence in decision making. In a subsequent review, NSIRA intends to further investigate policies of mitigation measures pertaining to their use and tracking.

CONCLUSION

This review assessed departments’ implementation of the directives received under the ACA and their operationalization of frameworks to address ACA requirements.

NSIRA’s first review of departments’ implementation of the Act and Directions was limited to a four month period (September-December 2019). As such, this review constitutes the first examination of the ACA over the course of one full year. NSIRA believes that it is now in a position to conduct in-depth case study assessments of individual departments’ adherence to the ACA and Directions, irrespective of whether or not a department reported any cases to its deputy head. Additionally, future reviews will follow up on the ongoing implementation of NSIRA’s past recommendations.

Annex A: Findings

NSIRA Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.

NSIRA Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.

NSIRA Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.

NSIRA Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.

Annex B: Canada Border Services Agency

Annex B: Canada Border Services Agency Framework

Framework updates: In 2018, Canada Border Services Agency (CBSA) issued a high-level policy document in response to the 2017 MD. Since then, CBSA has drafted updated policies and procedures that have not yet been finalized.

Working Groups: CBSA Avoiding Complicity in Mistreatment Working Group (ACMWG)

Senior Management Committee: Senior Management Risk Assessment Committee (SMRAC). This committee convenes on an as needed basis, to assess cases that have a potential for mistreatment.

[***description of CBSA’s decision making methodology***]

Country Assessment: In-house risk scoring template under development

Mitigation Measures: The CBSA is currently working to strengthen its formal framework/process for deciding whether substantial risk of mistreatment associated with a given request can be mitigated.

Annex C: Canada Revenue Agency

Annex C: Canada Revenue Agency Framework

Framework Updates: The Canada Revenue Agency (CRA) indicated that it did not make any changes to its framework since last year’s response. The department continues to refine its processes and has developed the Canada Revenue Agency Exchange of Information Procedures in the Context of Avoiding Complicity in the Mistreatment by Foreign Entities Act.

[***departmental cabinet confidence***]

Working group: The CRA formed a Risk Assessment Working Group (RAWG) that developed a methodology to assess the human rights records of its information exchange partners, so that senior management can make informed assessments of the risk of mistreatment.

Canada has a large network of international partners with 94 tax treaties and 24 Tax Information Exchange Agreements. Canada is also a party to the Convention on Mutual Administrative Assistance in Tax Matters (MAAC), which includes 144 signatories. These International Legal Agreements allow the CRA to exchange information on request, spontaneously and automatically. Each legal agreement includes secrecy provisions (caveats) that govern appropriate use and disclosure. In addition, members of the Global Forum (Global Forum) on Transparency and Exchange of Information for Tax Purposes are subject to peer reviews on a cyclical basis, including on Confidentiality and Data Safeguard .

Senior Management Committee: During the review period a senior committee was not in place, however there was a formal process to escalate reviews/risk assessment through the Director, Director General and ultimately the Assistant Commissioner of the Compliance Programs Branch (CPB) who is accountable for the administration of the ACA.

Additionally, in July 2021, the CRA established an ACA governance framework that includes the ACA Panel, a senior management consultative committee to support risk assessments, reporting, recommendations, and priorities. The panel currently consists of DGs and Directors within the CPB and the Legislative Policy and Regulatory Affairs Branch. Also in July 2021, the CRA established an executive level committee to consider and develop recommendations on case specific engagements as well as issue identification and guidance. The committee consists of Directors across several directorates of the CRA that manage programs that are directly impacted by/reliant on exchange of information with other jurisdictions.

Triage: The initial assessment is done by a working level employee and requires, at minimum, director approval. The case may escalate to the DG and the AC and so on if there is doubt about risk mitigation.

In cases where risk was identified, there were challenges in conducting full assessments to determine if the risk was substantial, the CRA delayed disclosing the information until the full assessment could be completed. This was largely in part due to COVID-19. As such, files that normally would have been referred were temporarily put on hold and no action was taken during the review period.

The CRA informed NSIRA that funding from the November 2020 Fall Economic Statement was allocated to the creation of a dedicated risk assessment team. It is anticipated that the development and regular updating of country-level assessments and the preparation of individual-level risk assessments will transition to this new dedicated team housed within the CPB, in summer 2021.

The team will also be responsible for:

  • Creating and formalizing the framework for consulting with CRA senior management and other government departments and agencies;
  • Advising CRA officials who engage in exchange of information (EOI);
  • Identifying mitigation and other factors specific to the type of information that CRA exchanges and that would impact risk assessment;
  • Preparing annual and other reporting required under the Act and Directions;
  • Providing awareness and training sessions; and
  • Continuously improving documentation, policies, guidance, and procedures.

Country/Entity Assessments: Since January 2020, the CRA has completed their own set of mistreatment risk assessments for each potential information exchange, including the use of information received from the CRA’s information exchange partners in consultation with other Government of Canada partners. The CRA can only exchange information with another jurisdiction pursuant to a treaty, tax convention or other legal instrument that permits exchange of tax information.

The CRA uses a colour coded system to rate the risk related to a country: green; yellow; red. However, for specific or spontaneous exchanges of information, the CRA completes an analysis based on the specifics of the file to supplement the country specific risk assessment.

Mitigation Measures: Mitigation measures, including caveats (data safeguards and confidentiality provisions) are embedded in all legal instruments that govern and allow for all the CRA’s exchanges of information, while peer reviews of jurisdictions’ legal frameworks and administrative practices provide assurances of exchange partners’ compliance with international standards for exchange of tax information. According to CRA, all information exchanged during the review period were subject to these mitigation measures. Due to COVID19, and for the period under review, the CRA put on hold all exchanges where it was deemed there may be a residual potentially significant risk of mistreatment until a process and mitigation measures were in place, including to redact information. However, the CRA routinely redacted personal information where it would not impact the substance of the exchange for those mitigated risk exchanges that did proceed during this period.

Annex D: Communications Security Establishment

Annex D: Communications Security Establishment Framework

Framework Updates: No changes made to the framework in 2020. It is the same procedure as the last review period.

Working group: Based on the RFI, there are no working groups leveraged to assess the level of risk of mistreatment. The Mistreatment Risk Assessment Process follows a process that has been refined continuously since its inception in 2012. The higher the level of risk (low, medium, high, substantial), the higher approval authority required to exchange or use information.

Senior Management Committee: There is no Senior Management Committee. As explained above, CSE relies on an approval authority scale based on the level of risk (from low to substantial). Senior level officials are involved in the process when there are medium and high-risk cases, which require Director and Director General/Deputy Chief approval, respectively.

Triage: A CSE official performs an initial assessment by consulting the Mistreatment Risk Assessment (MRA), which considers equity concerns, geolocation and identity information, human rights assurances, risk of detention and a profile of the recipients’ human rights practices.

Low (For Low Risk Nations)

If the MRA indicates a low level of risk, the official will need Supervisor [***specific unit***], approval if they wish to proceed with the information exchange or use.

Low (For non-Low Risk Nations)

If the MRA indicates a low level of risk, the official will need Manager [***specific unit***], approval if they wish to proceed with the information exchange or use.

Medium

If the MRA indicates a medium level of risk, the official will need Director, Disclosure and Information Sharing approval if they wish to proceed with the information exchange or use.

High

If the MRA indicates a high level of risk, the official will need Director General, Policy Disclosure and Review or Deputy Chief, PolCom approval if they wish to proceed with the information exchange or use.

Substantial

If the MRA indicates a substantial level of risk, the official may not proceed with the information exchange or use.

Country Assessments: CSE establishes its own country assessments (which CSE refers to as Human Rights Assessments) by using information from OGDs, its own reporting, and open source information. Foreign entity arrangements are reviewed annually. These HRAs are part of CSE’s MRAs.

There are two types of MRAs: Annual and Case-by-case. Annual MRAs include foreign entities with whom CSE regularly exchanges information, [***description of the foreign entities with whom CSE exchanges information***] Caseby-case MRAs are conducted in response to particular requests. Case-by-case MRAs often concern individuals and information sharing activities. There are Abbreviated MRAs, which are a sub case-by-case MRA, and they are conducted for Limited Risk Nations. These nations are considered low risk by CSE.

When making MRAs, CSE does the following:

  • assesses the purpose of the information sharing;
  • verifies there are mistreatment risk management measures in existing information sharing arrangements;
  • reviews CSE’s internal records on the foreign entity under consideration;
  • consults other available Government of Canada assessments and reports related to the foreign entity;
  • assesses the anticipated effectiveness of risk mitigation measures; and
  • evaluates a foreign entity’s compliance with past assurances, based on available information.

CSE consults with GAC, DND, and the Ministers of Foreign Affairs and National Defence for some MRAs, usually case-by-case ones. CSE may also consult GAC for human rights-related advice in certain instances.

Mitigation Measures: CSE considers a number of mitigation factors, such as risk of detention, [***statement regarding information sharing obligations of partners***] caveats, formal assurances, and bilateral relationships. CSE’s principle mitigation measure is Second Party assurances. [***statement regarding information sharing obligations of partners***]

Identifying/Sensitizing: The DG, Policy Disclosure and Review or the DC PolCom review high-risk cases. 303 information-sharing requests were assessed for risk of mistreatment and 10 of them (3%) were referred to the Director, Disclosure & Information Sharing. For the 2020 review period, the Deputy Chief, Policy and Communications was responsible for ACA accountability and quality assurance.

Annex E: Canadian Security Intelligence Service

[***Info-graphic of CSIS’s Risk Assessment process***]

Framework Updates: While there were no changes during the 2020 review period, CSIS modified its procedure on January 2021. Most notably, cases will only be escalated to ISEC if the DG cannot determine if the substantial risk can be mitigated. In addition, CSIS merged the [***statement regarding internal process***] CSIS updated its human rights ‘Assurances’ procedures as a stand-alone policy. This policy requires CSIS Stations to seek assurances from [***statement regarding internal process***] coordination responsibilities for ISEC were moved to the ██████████. Through that, the █████ became ISEC’s Chair.

Triage: CSIS working-level officials do the initial assessment. This assessment requires the official to determine if one or more of the four risk criteria are met. These criteria are:

  • “Based on the available information about the foreign entity, if the information is disclosed or requested, is there a probability that the foreign entity will engage in torture or other forms of cruel, inhuman or degrading treatment or punishment against an individual(s)?”
  • “If the information is disclosed or requested, is there a probability that the foreign entity will disseminate the information in an unauthorized manner to a 3rd party, which may result in torture or other forms of cruel, inhuman or degrading treatment or punishment against an individual(s) by that 3rd party?”
  • “If the information is disclosed or requested, is there a probability that it may result in the extraordinary rendition of an individual(s) by the foreign entity which would lead to the individual(s) being tortured or subject to other forms of cruel, inhuman or degrading treatment or punishment?
  • “If the information is disclosed or requested, is there a probability or an extrajudicial killing of an individual(s) by the foreign entity or other security entities within the country?”

Four scenarios could occur before a case lands at ISEC:

[***description of four possible scenarios and the assessment criteria used to determine risk mitigation and/or ecalation***]

Working Group: While there is a senior management committee, there is no working level group on the operations side.

Senior Management Committee: ISEC is CSIS’s senior-level review committee for foreign information sharing activities. It is composed of CSIS senior managers and representatives from DoJ and GAC. This committee is responsible to determine if a case poses a substantial risk and if it can be mitigated. If ISEC cannot determine if the substantial risk is mitigatable, the case is referred to the Director. Of note, GAC and DoJ are no longer voting members on ISEC but will continue to provide feedback and advice.

Country Assessments: CSIS conducts its own country assessments. Each information exchange arrangement with a foreign entity has its own Arrangement Profile (AP). APs include a summary of the human rights summary.

Mitigation Measures: CSIS relies on a few mitigation measures. First, CSIS widely uses ‘Form of Words’, which include caveats. Second, CSIS uses assurances and relies on standardized templates provided to foreign entities. CSIS may also tailor assurances to address specific concerns, such as extra-judicial killings.

Identifying/Sensitizing Information: ██████ is responsible for CSIS’s information sharing framework. [***name of a specific unit***] is responsible for official policy management. Concerned program areas are responsible for applying related polices and procedures for ACA-related activities.

Annex F: DFO

Annex F: DFO Framework

Framework Updates: Fisheries and Oceans Canada (DFO) did not make any changes to last year’s approach.

Triage: The initial assessment is made by the person receiving the request for information sharing or who first comes into possession of information derived from a foreign source. Risk is determined on a case-by-case basis.

The sector-level analyst/officer does the initial assessment and relies on OGD assessments to determine the level of risk. They determine the level of risk in relation to the specific case and whether they assess that there is a substantial risk or not will impact the level of approval. If the analyst/officer does not think there is risk, the case may proceed. This, according to the decision screen and information received, does not require any manager or senior level approval.

If the analyst/officer believes or is unsure that there is a substantial risk, the senior-level Internal Review Committee (IRC) must seek DM approval.

Working Group: Internal Review Committee

Senior Management Committee: DFO employs the use of a decision screen and the IRC as demonstrated above. It is unclear whether DFO has developed guidance to help officials and management accurately and consistently determine the risk of mistreatment.

Country Assessments: DFO relies on country assessments conducted by GAC (as well as DFO legal services, RCMP and CSIS as needed) to make mistreatment risk determinations.

Mitigation measures: DFO indicated that it employs the use of caveats and assurances as necessary but has not yet had to seek such assurances. As such, there is no tracking mechanism in place. The Department is able to retroactively determine when, how, and why a decision was made through its record keeping system. A process is in place to record the details of each case, its evaluation process, and any resulting actions and decisions.

Annex G: Department of National Defence/Canadian Armed Forces

Annex G: Department of National Defence/Canadian Armed Forces Framework

Framework Updates: The Department of National Defence (DND) indicated that there were no changes to its framework since last year’s response.

Triage: The process of assessing risk is largely the same across all three forms of information sharing transactions. The process involves examining country human rights conditions, and researching specific partner entities, including any reports of mistreatment. Adverse information on a foreign partner is reviewed by the Defence Information Sharing Working Group (DISWG) and recommendations are made to the implicated L1s on how to manage information sharing activities (request, disclosure, or use). There are no differences in the types of mitigation measures employed across the three forms of information sharing. The primary governance document Release and Disclosure Officers (RDOs) and Release and Disclosure Authorities (RDAs) must adhere to is the CDI Interim Functional Directive: Information Sharing with Certain Foreign States and their Entities.

Working Group: The Defence Information Sharing Working Group (DISWG) is a working-level committee led by the Release and Disclosure Coordination Office (RDCO) within CFINTCOM that serves as an advisory body to operation Commanders regarding issues covered under the ACA. This Working Group exists as a platform for open dialogue related to information sharing arrangements and transactions. This group convenes monthly, or as required.

Senior Management Committee: The Defence Information Sharing Assessment Committee (DISAC) is chaired by the Chief of Defence Intelligence / Commander CFINTCOM . The DISAC’s primary object is to act as an advisory committee for the Deputy Minister and the Chief of Defence Staff in support of their decision making regarding issues pertaining to the ACA.

Country Assessments: Currently, RDCO has established a list of low-risk countries that can be referred to by other L1s. Inclusion in this list indicates CDI’s confidence that sharing information with government entities of that foreign state can take place without a substantial risk of mistreatment. Moreover, RDCO has developed a draft methodology for Country Human Rights Profiles to classify countries as low, medium, or high risk but has only begun producing country human rights profiles on a few medium and high-risk countries and the methodology has not yet formally approved. These profiles will be used by other L1s in the development of specific Partner Entity Assessments and to inform the overall risk assessment of sharing information with foreign entities.

Information Management: There is no common shared system or repository for all RDOs. Information decisions are recorded by RDOs at the unit level. In some cases, all transactions are recorded using a spreadsheet and should include all details relating to the collection, retention, dissemination or destruction of the information, but the precise format will vary. CFINTCOM is working to standardize RDO logs across DND/CAF. From an information management perspective, there have been no changes since last year’s report. Records of discussion of all DISWG meetings are kept centrally within RDCO/CFINTCOM and it is possible to retroactively determine how and why a decision or recommendation was made.

Mitigation Measures: DND uses mitigation measures to reduce the risk of mistreatment. For example, DND uses measures such as the sanitization of information, the inclusion of caveats, and/or the seeking of assurances, including on low-risk cases in order to err on the side of caution.

Annex H: FINTRAC

Annex H: FINTRAC Framework

Framework Updates: The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) did not make any changes to their framework for the 2020 review year.

Triage: Who does the initial assessment will depend on the risk level classification of the country. If it’s green, the intelligence analyst (IA) does the risk assessment. If it’s yellow, the IA’s team leader does the risk assessment. If it’s red, Senior Level does the risk assessment. Regardless of the determined risk level, Senior Level must ultimately approve or decline the information exchange/use.

Partnerships and Working Groups: FINTRAC makes use of external organizations, such as the Egmont group, to ensure that member organizations are adhering to global standards against mistreatment. If one of these groups is found to have breached their duty of care, and is expelled from the group, then FINTRAC will cease to exchange information until the matter has been rectified. FINTRAC enters Memoranda of Understandings (MOUs) with nations who wish to exchange information with them. To do so, each nation is assessed using a variety of criteria to determine their risk rating and whether an MOU should be established.

FINTRAC also regularly participates in ISCG meetings alongside other departments.

Senior Management Committee: FINTRAC does not have a senior management committee to determine risk like other departments. Instead, they rely on senior management and the Director to make final decisions on cases.

Country Assessments: FINTRAC established its own country assessments. Establishing each country assessment involves gathering pertinent information on the human rights situation in the country and using indicators to assess the risk level of mistreatment of each country. During the development of the country assessment process, FINTRAC consulted with other agencies/government departments captured under the ACA.

The Manager of International Relationships is responsible for monitoring and assessing the human rights profile of countries with which FINTRAC shares an MOU.

Mitigation Measures: Caveats and assurances are established at the signing of an MOU and repeated whenever sharing information with any foreign entity. The sharing of information is not allowed without a signed MOU.

Annex I: Global Affairs Canada

Annex I: Global Affairs Canada Framework

Framework Updates: Global Affairs Canada (GAC) indicated that no changes to their framework was made during the current review period.

Triage: There is not one unified set of processes at GAC for determining whether information being used by the department is likely to have been obtained through the mistreatment of an individual by a foreign entity. If an official determines that information that he or she has received is likely to have been obtained through the mistreatment of an individual by a foreign entity and that official still wants to use the information, they are instructed in their training to consult with their Program management at HQ. Should that manager be unable to make a determination on their own as to whether the use would comply with the Act, they will consult the relevant departmental policy group and the department’s Legal Services Unit.

Working Groups: The Ministerial Direction Compliance Committee Secretariat

Senior Management Committees: The Ministerial Direction Compliance Committee (MDCC) meetings focuses on the following:

  • Has the information, the use of which is being sought, likely been derived from mistreatment?
  • What are the proposed measures to mitigate the risks? What is the likelihood of their success?
  • Consider the justifications for and proportionality of any potential involvement with the foreign state or entity that may result in mistreatment.

The MDCC Secretariat will create a record of decision and circulate it for comment by MDCC members. Once finalized, it will be kept by the Secretariat for future reporting. The MDCC Secretariat follows up with the requesting official for updates on the outcome of the situation and requests a final update from the requesting official once the situation is resolved. Currently the MDCC Secretariat consists of one person.

Country Assessments: Global Affairs Canada’s human rights reports provide an evidence-based overview of the human rights situation in a particular country, including significant human rights-related events, trends and developments and include a section focused on mistreatment. There are no scores for countries however, and it is up to the officials to assess the risk based on the information in the reports.

Mitigation Measures: The Legal Services Unit and/or Intelligence Policy and Programs division will provide guidance on the limitations and the prohibitions of the use of information obtained through mistreatment. They are also able to propose potential mitigation measures, such as sanitization of the information, if there is a risk of further mistreatment; of depriving someone of their rights or freedoms; or if the information could be used as evidence in any judicial, administrative or other proceeding.

Annex J: IRCC

Annex J: IRCC Framework

Framework Updates: Immigration, Refugees and Citizenship Canada (IRCC) indicated that there were no changes to its procedures regarding the disclosure of information to foreign entities.

Triage: The initial assessment is done by the employee/officer receiving a request to disclose information. Officers are provided with a country assessment tool that provides a country-level risk assessment. If the country is listed as low-risk and the employee does not believe there are any risks of mistreatment, they may proceed with the exchange and record the details of that exchange (i.e., what information was exchanged; to which country, etc) into the Global Case Management System (GCMS). If the country is high-risk, or the officer believes that there is any risk of mistreatment and they wish to pursue with the case, then the officer is required to refer the case to IRM and Admissibility to assess the risk of the exchange.

Senior Management Committee: IRCC has the Avoiding Complicity Assessment Committee. The Committee is comprised of executives representing relevant policy, operations, legal and privacy branches within the Department. The purpose of the Committee is to reassess whether the circumstances of the case meet the “substantial risk” threshold, and to determine whether mitigations could be sufficiently imposed to allow for the disclosure. If the Committee is unable to unanimously determine if the risk can be mitigated, and there remains a need to disclose the information to the requesting foreign entity, then the case will be referred to the Deputy Minister for final decision.

Country Assessments: IRCC officers are instructed to refer to an initial country assessment tool when they are contemplating any disclosure or request for information from a foreign entity. This tool provides a general assessment of the country’s risk. If the country is identified as a high-risk country, then the officer is required to make a Consultation Request before disclosing, requesting or using information. If the country is identified as medium-risk, then it is recommended that the officer make a Consultation Request.

Mitigation Measures: Possible mitigation measures for a case where a substantial risk of mistreatment has been determined, if available, would be established in the Consultation Request assessment and, if necessary, in the Avoiding Complicity Assessment Committee’s recommendation. In either case, the mitigations will be manually recorded in the case file where they can be later recalled and noted in the Annual Report.

Annex K: Public Safety

Annex K: Public Safety Framework
Annex K: Public Safety Framework Image 2

Please note that the above flow charts are draft and have not yet been approved.

Framework Updates: Public Safety (PS) does not yet have a framework for deciding whether an exchange of information with a foreign entity would result in a substantial risk of mistreatment of an individual. PS noted, however, that it has drafted a departmental policy to support the department’s implementation of the Directions but it has not yet been approved by senior management.

Triage: PS officials at the operational level are responsible for identifying whether the disclosure of or request for information would result in a substantial risk of mistreatment of an individual. Prior to the disclosure of or request for information to/from a foreign entity, PS officials, as per the draft policy, are expected to:

  • review risk assessments and information sharing arrangements/agreements to determine risks;
  • identify mitigation measures as needed; and
  • seek DG approval for the disclosure or request; and the DG would determine whether the risk can or cannot be mitigated and whether the case should be referred to the DM for determination and decision.
  • PS officials at the operational level are responsible for identifying whether information for potential use was likely obtained through the mistreatment of an individual. As per the draft policy, prior to the use of information, PS officials are expected to:
  • conduct an assessment to determine if the information was likely obtained through the mistreatment of an individual, if not previously completed by PS officials or another government department, and mark it accordingly, based on DG-level determination;
  • assess and characterize the accuracy and reliability of the information; and,
  • advise their DG of the circumstance; and the DG would determine whether the information would be used as per section 3 of the Directions and refer the decision to the DM to determine if the use of information in any way that deprives someone their rights or freedoms is necessary to prevent the loss of life or significant personal injury.

For PS program areas where responsibilities for program delivery are shared among multiple Government of Canada departments, PS officials may use accuracy and reliability assessments conducted by another Government of Canada department for the express purpose of the specific information exchange. In these cases, and where PS does not have sufficient information (such as the source of the information) to conduct an assessment, it will require Government of Canada departments to attest to having conducted the assessment. This same principle applies risk assessments and assessments as to whether information was likely obtained through the mistreatment of an individual.

Working Group: The ISCG is the primary interdepartmental forum for supporting interdepartmental collaboration and information-sharing between members as they implement the Act and Directions and is regularly attended by all members.

PS participates in the ISCG in three ways as the:

  1. chair, coordinator and PS policy lead;
  2. area responsible for implementing the ACA;
  3. legal counsel representative.

PS has also made progress with ISCG guidance. However, due to COVID-19, the ISCG was limited in its capacity to convene meetings.

Senior Management Committee: PS does not have a formal senior management committee to review high-risk cases. The Investigative Authorities and Accountability Policy (IAAP) unit supports program areas in the referral process to the Senior Assistant Deputy Minister (SADM) of the National and Cyber Security Branch for further examination. Acting as a senior Public Safety official, the SADM is responsible for referring cases to the Deputy Minister if they are unable to determine whether the risk of mistreatment can be mitigated.

Country Assessments: PS currently does not have any country assessments completed and plans to use other department’s assessments, but as outlined in its draft policy, PS expects to conduct country and entity assessments as part of its annual risk assessment process. The risk assessment process will ensure that an agreement with the foreign entity is in place prior to information sharing exchanges; review risk and country assessments developed by portfolio agencies (e.g. CSIS) and other departments (e.g. GAC), and consider human rights reporting from non-government entities.

The IAAP will coordinate, on an annual basis, risk assessments. To do so, IAAP may, for example, review human rights reports developed by Global Affairs Canada (GAC), country assessments prepared by portfolio agencies (e.g. CSIS), human rights reporting from non-government entities and country/entity specific material.

Mitigation Measures: PS currently has developed a draft policy to address mitigation measures and caveats. The draft policy will provide guidance to officials on how to assess risk and apply mitigation measure, while also defining approval levels and country assessment responsibilities.

Once a risk of mistreatment has been identified, the PS official is required to undertake a risk mitigation assessment prior to requesting the information. Approved risk mitigation mechanisms include:

  • the caveating of information,
  • obtaining assurance and/or
  • disclosing a limited amount of the information.

The policy also outlines requirements regarding the use of congruent mitigation mechanisms to collectively reduce the risk.

Annex L: Royal Canadian Mounted Police

Annex L: Royal Canadian Mounted Police Framework

Framework Updates: There were no changes to the Royal Canadian Mounted Police’s (RCMP) framework in 2020. RCMP has undertaken a number of internal reviews of its information sharing framework and continues to refine and optimize its processes.

RCMP also noted that it was in its final stages of rolling out an online training course specifically tailored to the ACA.

Triage: The Foreign Information Risk Advisory Committee (FIRAC) process may be initiated if and when an information exchange involves a country identified as high or medium risk. A low-risk case would only be sent if an official believes there is the potential for mistreatment.

All RCMP personnel are required to consider the risk of mistreatment before requesting, disclosing or using information and to engage the FIRAC process if there is a substantial risk identified to a specific individual(s) with a country of exchange.

An employee is almost always the one to perform the initial risk assessment. When an entity is green, the employee may exchange or use information without consulting FIRAC, unless they express doubts. When an entity is yellow, the employee must consider whether or not there is a substantial risk of mistreatment by looking at a list of criteria (similar to CSIS). If one or more of these criteria is present, the employee must send the case to FIRAC. If the entity is red, the employee must send the case to FIRAC for the initial assessment, unless no personal information is exchanged.

Working Group: Law Enforcement Assessment Group (LEAG). Full-length LEAG assessments include classified information from other Federal departments and agencies. The FIRAC Portal was developed to allow RCMP employees to access the assessments, and to further support compliance with the directions.

Senior Management Committee: FIRAC was established to facilitate the systematic and consistent review of RCMP files to ensure information exchanges do not involve or result in the mistreatment of any person.

FIRAC holds the responsibility to determine if a substantial risk exists and in cases where a substantial risk of mistreatment exists, make a recommendation on whether the proposed mitigating measures are adequate to mitigate the risk.

FIRAC’s recommendations are made by the Chair, upon the advice of the Committee, to the appropriate Assistant Commissioner / Executive Director responsible for the operational area seeking to disclose, request or use the information.

FIRAC determines if the risk is mitigatable or not. If it is, the case goes to the Assistant Commissioner. If it is not, FIRAC declines the exchange or use of information.

Country Assessments: An in-house country assessment model has been completed.

Countries are listed in alphabetical order, along with any specific foreign entities (i.e. police forces, military units, etc.) that have been assessed. For each entity, the risk level (Red-High, Yellow-Medium, Green-Low) is provided, as are the specific crime types and conditions.

Mitigation Measures: The RCMP leverages existing MOU’s with specific partners to partially mitigate underlying risk, in particular where mutually agreed standards around human rights exist as well as having a good track record for respecting caveats. Similarly, officials work with Liaison Officers to identify any relevant assurances or strategies, factors or conditions that could mitigate the risk of mistreatment posed by the information exchange, request for information or use of information.

All mitigation measures used are tracked through the FIRAC by filling in a FIRAC Request Form. Noting which mitigations/caveats are used is a mandatory part of the process.

Annex M: Transport Canada

Does not have a departmental framework for assessing ACA considerations, outside of the Passenger Protect Program (PPP).

Changes: Transport Canada (TC) developed a corporate policy in September 2020 to highlight the department’s ACA-related requirements, roles and responsibilities and remains a participant in PS framework.

Triage: Relies on PS’ framework for the Passenger Protect Program.

Should they have any concerns about a request for information from a foreign partner they will consult with other agencies, such as CSIS or GAC.

Working Group: TC is a voting member of the PPP Advisory Group but does not have any responsibility for drafting case briefs. At each meeting of the PPP Advisory Group, TC has ensured that all other voting members have acknowledged TC’s SATA-legislated responsibility for sharing the List with domestic and foreign air carriers, and its associated responsibilities under the ACA.

Senior Management Committee: TC does not have any senior management committee in place to further review cases with a potential for mistreatment.

Country Assessments: Rely on other government departments.TC relies on assessments by other departments such as PS and GAC.

Mitigation measures: The framework was established by Public Safety (lead on PPP), with consultations with the PPP partners (RCMP, CSIS, CBSA). TC has worked with PS to integrate mitigation measures into the operating procedures and protocols of PPP partners.

Share this page
Date Modified: