Chapter 2: A Functional Overview of the Security and Intelligence Community
National Security and Intelligence Committee of Parliamentarians Annual Report 2018

What is national security and intelligence?

45. NSICOP has a mandate to review issues of national security and intelligence. However, neither "national security" nor "intelligence" is defined in the National Security and Intelligence Committee of Parliamentarians Act (NSICOP Act) that established the Committee's mandate, nor are they defined in other legislation.

46. Official definitions of national security have changed over time. In 1979, the McDonald Commission proposed a simple definition of national security: the need to preserve Canadian territory from attack and to preserve and maintain the democratic process of government. ^{Footnote 1} In 2004, the Government stated that national security relates to threats that have the potential to undermine the security of the state or society and that require a national response. It said that national security focused on three core interests: protecting Canada and Canadians at home and abroad; ensuring Canada is not a base for threats to its allies; and contributing to international security. ^{Footnote 2} From this relatively narrow focus on security, the Government adopted a broader view. For example, a 2017 document provided to the Committee defined national security as "protecting the safety and security of Canada's territory, government, economy and people, and the promotion and protection of Canadian interests." ^{Footnote 3} This latter definition is understandably broad: issues of security are deeply integrated with those of foreign affairs, trade and the economy, social issues, health, and the environment. As discussed in paragraph 33 of Chapter 1, the Committee has adopted a working definition of national security to help it determine what activity or issue it should review.

47. The definition of intelligence, on the other hand, has a stronger basis in law, but also suffers from some ambiguity. The Committee notes that there are many types of intelligence. In the National Defence Act, "foreign intelligence" is defined as:

Information or intelligence about the capabilities, intentions or activities of a foreign individual, state, organization or terrorist group, as they relate to international affairs, defence or security.

Security intelligence is another type of intelligence. It is not defined in legislation, but relates to threats to the security of Canada as defined in the CSIS Act, specifically espionage or sabotage, foreign influenced activities, terrorism, and the violent overthrow of the government. The Committee notes that other types of intelligence exist, including defence intelligence, criminal intelligence, and financial intelligence. There are also many means of collecting intelligence, such as recruiting human sources of information (known as human intelligence), intercepting communications (known as signals intelligence or communications intelligence), and using public sources of information (known as open source intelligence). As discussed in paragraph 33 of Chapter 1, the Committee has adopted a working definition of intelligence to help it determine what activity or issue it should review.

Who belongs to the security and intelligence community?

48. A number of government organizations are responsible for keeping Canadians safe and for helping to promote Canadian interests abroad. Canada's security and intelligence community has seven core federal organizations that have mandates that are either entirely or substantially related to national security, intelligence, or both. The Committee added an eighth, the Prime Minister's National Security and Intelligence Advisor (NSIA), because of the important role the Advisor and his or her officials play in advising the Prime Minister and coordinating much of the security and intelligence community (see Table 1). Nine other organizations belong to the community, but have mandates and activities that are broader than either security or intelligence (see Table 2). These organizations have evolved over time in response to government priorities, legislative changes, and new challenges and threats. Over the past year, the Committee has visited each of the core members of the security and intelligence community and gained a better understanding of their mandates, authorities, and activities. It has also been briefed on the roles of the other organizations.

49. The 2016-2017 National Intelligence Expenditure Report gives some idea of the size and scope of the intelligence community in Canada. This report on the resource allocation of federal departments and agencies to support the Government of Canada's intelligence priorities notes a budget of approximately *** and approximately *** full-time employees across 10 organizations. ^{Footnote 4} By way of comparison, the Australian intelligence enterprise in 2016-2017 represented approximately CAD$2 billion and 7,000 staff spread across 10 agencies. ^{Footnote 5} While Canada's National Intelligence Expenditure Report does not provide the total sum of costs associated with all intelligence activities, these figures do provide a useful comparison to a key ally of similar size and scope.

Core Members of the Security and Intelligence Community

Other Federal Departments and Agencies involved in National Security and Intelligence

• Canadian Coast Guard
• Financial Transactions and Reports Analysis Centre of Canada
• Immigration, Refugees and Citizenship Canada
• Innovation, Science and Economic Development Canada
• Justice Canada
• Natural Resources Canada
• Public Health Agency of Canada
• Public Safety Canada
• Transport Canada

50. While the security and intelligence organizations each have specific mandates and responsibilities, they share common objectives (e.g., keeping Canadians safe) and work together to achieve them. In short, they function as a community: their breadth and level of engagement is unique in government. While accountability for each of the individual departments and agencies is exercised by the responsible minister, issues of national security and intelligence have long been considered of exceptional importance and sensitivity.

51. The Prime Minister and Cabinet therefore play an important leadership and coordination role over the community as a whole. As of late August 2018, the committee responsible is the Cabinet Committee on Canada in the World and Public Security, which is chaired by the Minister of Health. In addition, the Prime Minister has created the Incident Response Group (IR G). The IRG brings together relevant ministers and senior government leadership to coordinate federal responses to national crises or incidents elsewhere that have major implications for Canada. Prior to August 2018, the Prime Minister chaired the Cabinet Committee on Intelligence and Emergency Management, which met to consider intelligence reports and priorities, to coordinate and manage responses to public emergencies and national security incidents, and to review the state of Canadian readiness. In the past, similar functions were played by other permanent and ad hoc Cabinet committees.

52. The Prime Minister is advised by the NSIA, a senior official responsible for coordinating and providing leadership to the security and intelligence community. The NSIA regularly briefs and provides advice to the Prime Minister and other government officials on national security and intelligence issues, including for seeking the Prime Minister's concurrence to conduct particularly sensitive activities.

53. The NSIA reports to the Clerk of the Privy Council and is responsible for three organizations in the Privy Council Office: the Foreign and Defence Policy Secretariat, the Security and Intelligence Secretariat, and the Intelligence Assessment Secretariat. These Secretariats help to coordinate the operational, policy, and assessment activities of the community in the areas of foreign affairs, defence, security, and intelligence. The NSIA chairs two deputy minister-level committees, one on operations (which meets weekly) and one on intelligence assessment (which meets monthly). The NSIA cc-chairs with the Deputy Minister of Public Safety a monthly deputy minister-level committee on national security. These committees are supported in turn by officials from across the community. The NSIA also leads ad-hoc meetings of officials to address significant events or crises. The office of the NSIA has no statutory basis, but relies on the authority derived from his or her position at the Privy Council Office and as a principal advisor to the Prime Minister. The biennial process to identify, approve, and implement intelligence priorities, which the NSIA coordinates, is an important mechanism to govern the community and ensure accountability to ministers and Cabinet. This issue is discussed further in chapter 3.

54. Public Safety Canada plays a coordination and leadership role in national security. The Minister of Public Safety and Emergency Preparedness is accountable for three core members of the security and intelligence community: the Canadian Security Intelligence Service (CSIS), the Royal Canadian Mounted Police (RCMP), and the Canada Border Services Agency. The Minister is regularly briefed on the activities of those organizations and approves a number of their operations. The department leads, coordinates, or supports several security processes, including the processes of listing terrorist entities, listing individuals on the Passenger Protect Program, and conducting national security reviews of foreign investments. ln cyber security, the department works with other government departments and the private sector to mitigate cyber threats to critical infrastructure (for example, the financial system) and to promote cyber security to Canadians. The Deputy Minister of Public Safety leads a deputy minister level committee on cyber issues, which meets as required to discuss cyber threats, operations, and policy issues.

55. The work of these organizations is vital. Every day, government employees across the country and around the world - intelligence officers, police investigators, diplomats, soldiers, and border services officers, to name a few - work to protect Canadians and to advance Canadian interests in areas like trade and international relations. Some of these organizations use sophisticated and covert methods to conduct their work and are subject to significant levels of oversight and review, including through the courts, ministerial approvals, and independent review bodies.

56. The Committee is of the view that this work is not well understood. Canadians do not appear to have a strong understanding of the individual mandates or activities of each of the organizations of the security and intelligence community, how they work together, or the role of their review bodies. For example, recent public opinion research shows that only 3 percent of respondents could correctly identify the Communications Security Establishment (CSE) unprompted and only 37 percent said that they had previously heard about the organization. ^{Footnote 6} Other research shows that only 3 in 10 Canadians can identify CSIS. ^{Footnote 7} Department of National Defence and the Canadian Armed Forces (DND/CAF) public opinion research shows that only 26 percent of Canadians had some awareness of the military's activities from the past year and a half. ^{Footnote 8} However, information on these organizations is publicly available. Each has a website which describes its roles and authorities (CSE is particularly good in this regard), and both the Security Intelligence Review Committee and the CSE Commissioner have published detailed reports on their reviews of the work of the two key organizations, CSIS and CSE, annually. There is also a wealth of academic and online resources to inform Canadians. The Committee believes that Canadians would be well served if government information were more user-friendly. More specifically, it believes that the public would benefit from information that explains how security and intelligence works and the role that government organizations play individually and in concert to protect Canadians and to advance their interests. That information should be consolidated for ease of reference and standardized for completeness.

57. There appears to be a similar lack of awareness of threats to Canada's national security. As it stands now, an interested Canadian would have to search a number of government websites to understand the most significant threats to Canada. For some threats, such as terrorism, information is readily available and regularly updated (for example, the annual Public Report on the Terrorist Threat to Canada). For other threats, such as organized crime or interference in Canadian domestic politics, information is often limited, scattered among different sources or incomplete. The Committee believes that Canadians would be equally well served if more information about threats were readily available.

Keeping Canadians safe

58. The following section provides a high-level, functional overview of Canada's security and intelligence community. It does not detail the mandate, authorities, and activities of all of the community's members, with one exception (DND/CAF, described in chapter 4). Nor does it try to address the gaps noted above - the Committee believes that the ministers accountable for the departments themselves are responsible for better informing Canadians about the range of threats facing Canada and the role that certain organizations play in addressing them. Rather, the section reflects what the Committee has learned through its interaction with the security and intelligence community since its inception.

59. The Government states that its first priority is to protect the safety and security of Canadians at home and abroad. ln a national security context, that involves a range of activities to detect, prevent, or disrupt threats to the security of Canada. Key members of the security and intelligence community provided the Committee with an overview of the most significant national security threats. Briefings and open source information provided to the Committee on these issues form the basis of the following functional overview.

Terrorism

60. The Privy Council Office briefed the Committee on a number of threats to Canada's national security. The first was terrorism. Over the years, there have been many terrorist threats to Canada and its allies. The terrorist threats facing Canada now are elaborated in the 2017 Public Report on the Terrorist Threat to Canada. ^{Footnote 9} The report states that violent extremists inspired by AI-Qaida and Daesh continue to be the main terrorist threat to Canada and that these groups are able to communicate with ease with the use of social media and encryption technologies. According to the Integrated Terrorism Assessment Centre, the national threat level for terrorist attacks is currently medium, meaning that a violent act of terrorism could occur and that additional measures are in place to keep Canadians safe. ^{Footnote 10} The threat level was set following a 2014 speech by Daesh encouraging attacks in Canada. The October 2014 terrorist attacks in St-Jean-sur-Richelieu and in downtown Ottawa occurred shortly thereafter and the threat level has not changed since. The Integrated Terrorism Assessment Centre assigns different threat levels to each of Canada's major municipalities and to different types of transportation (for example, rail or commercial air); ***. Threat level assessments provide government officials and law enforcement agencies with details on risks and vulnerabilities to inform mitigation strategies and security postures.

61. The federal organizations with primary responsibility for investigating, preventing, or disrupting terrorist threats are CSIS and the RCMP. As an intelligence organization, CSIS collects and analyzes information for the purpose of advising the Government of Canada on threats to the security of Canada, while the RCMP collects evidence that can be used in court proceedings. CSIS can initiate an investigation on the suspicion of conduct that may threaten national security, but the RCMP, as a law enforcement organization, requires a reasonable belief that a crime will be or has been committed. As CSIS obtains more intelligence, it may take increasingly intrusive investigative steps, including applying to the Federal Court for a warrant to intercept a target's telephone or Internet communications. If the behaviour of a subject of investigation reaches a threshold for criminality, CSIS will notify the RCMP, which may initiate a criminal investigation. When the RCMP conducts an investigation, it must be able to disclose information and evidence in court. The RCMP may also seek a court warrant to intercept a suspect's communications or use other intrusive methods of surveillance, such as searches of property or installing tracking devices on vehicles. In some cases, CSIS and the RCMP may conduct parallel investigations to ensure intelligence or evidence is collected to respond to each of their respective mandates. This coordination and cooperation is guided by the terms of the CSIS-RCMP One Vision agreement, which ensures the organizations take a collaborative approach to the management of threats.

62. In other cases, the RCMP may investigate a potential threat alone or in coordination with a provincial or municipal police service, or an international partner, such as the United States Federal Bureau of Investigation (FBI). A recent example occurred in August 2016, when the FBI provided the RCMP with information that allowed the RCMP to identify and locate Aaron Driver, a Daesh sympathizer who was planning to attack Union Station in Toronto. The RCMP worked with local police agencies to stop Mr. Driver from conducting the attack, and he was fatally shot in a confrontation with police.

63. Certain security and intelligence organizations can take a number of measures to prevent and disrupt terrorist plots. Police investigations are primarily aimed at laying charges and prosecution. However, not all investigations reach that stage, and police may decide to take other measures to reduce the risks of violent criminal behaviour, such as seeking a peace bond to prevent an individual from engaging in certain behaviours. CSIS and the RCMP may work with Public Safety Canada to place someone's name on the Passenger Protect list. CSIS may also take measures to reduce threats, for example, to make parents aware that their child is accessing extremist material online. For its part, the Canada Border Services Agency (CBSA) may inspect an individual's goods when the individual is seeking entry into Canada, deny non-citizens entry if they are deemed a security risk, and ensure that high-risk individuals are brought to the attention of the appropriate organizations (for example, the RCMP or CSIS).

64. Public Safety Canada plays a leadership and coordination role in fighting terrorism. This department is responsible for Canada's Counter-terrorism Strategy. The Strategy consists of four elements -prevent, detect, deny, and respond -and its overarching goal is to counter domestic and international terrorism to protect Canada, Canadians, and Canadian interests. ^{Footnote 11} Public Safety Canada also plays a leadership and coordination role in countering radicalization to violence, including the establishment of the Canada Centre for Community Engagement and Prevention of Violence. ^{Footnote 12}

Espionage and foreign influence

66. The second national security threat identified to the Committee by the Privy Council Office was espionage and foreign influence. Espionage activities primarily involve foreign states trying to obtain political, economic, and military information, or proprietary business information, through clandestine means. Foreign influence or interference activities involve foreign states using clandestine or deceptive methods to influence or manipulate Canadian immigrant communities, political parties, and government officials.

67. Russia and China are *** among a handful of states who conduct espionage and foreign influence activities in Canada. Russia has repeatedly sent intelligence agents to Canada to establish false identities and conduct espionage. Examples include a Russian couple known as Ian and Laurie Lambert, whom CSIS discovered conducting espionage activities in 1996 in Toronto and were deported; a Russian man known as Paul William Hampel, who was arrested in Montreal as he tried to leave Canada in 2006; and a Russian couple known as Tracey Foley and Don Heathfield, who had lived in Montreal and Toronto using false Canadian identities and who were arrested in the United States in 2010 and returned to Russia. In January 2012, an officer in the Royal Canadian Navy, Jeffrey Delisle, was arrested for providing information to Russia. He was found guilty and convicted in 2013. ln March 2018, Canada expelled four Russian diplomats as part of a coordinated global effort to punish Russia for the poisoning of two people in the United Kingdom, noting that the diplomats had been "identified as intelligence officers or individuals who have used their diplomatic status to undermine Canada's security or interfere in our democracy." ^{Footnote 13}

68. China is known globally for its efforts to influence Chinese communities and the politics of other countries. ^{Footnote 14} The Chinese government has a number of official organizations that try to influence Chinese communities and politicians to adopt pro-China positions, most prominently the United Front Work Department. The Director of CSIS raised concerns about Chinese influence activities against Canadian politicians in 2010, and a former Canadian Foreign and Defence Policy Advisor to the Prime Minister and later Canadian Ambassador to China stated in 2017 that China used diaspora groups and mobilized Chinese students to influence Canadian politics. ^{Footnote 15} In 2016, concerns were raised about wealthy Chinese businessmen with close connections to China's Communist Party making political donations in Canada. ^{Footnote 16} Similar issues have been raised in countries with large Chinese diaspora populations. Media and academic reports point to China's efforts in Australia and New Zealand to influence government policies, including through significant political donations, covertly supporting community groups and demonstrations, and influencing Chinese-language media. ^{Footnote 17} Chinese police and security officials have also been caught in foreign states operating without permission to persuade or coerce Chinese fugitives to return to China. ^{Footnote 18} ***

69. Similar to their roles related to terrorism, CSIS and the RCMP have primary responsibility to investigate and counter espionage and foreign influence. As with other investigations on threats to the security of Canada, CSIS may take a range of measures to investigate and reduce the threat of espionage or foreign influence activities in Canada. The RCMP may conduct a criminal investigation, as it did in the espionage case of Jeffrey Delisle. Global Affairs Canada may be involved should foreign diplomats be found to be conducting such activities and required to leave Canada, as has happened repeatedly with diplomats from Russia and other countries. ^{Footnote 19} CSIS officials told the Committee that the threat of espionage and foreign influence was growing in Canada and will likely require a more significant response in the years ahead. The Committee agrees and notes that Australia passed legislation in June 2018 to better prevent, investigate, and disrupt foreign interference.

Cyber threats

70. Cyber threats were another significant national security threat identified to the Committee. In a 2017 study, CSE stated, "nation-states are constantly deploying cyber capabilities to try to gain access to Government of Canada networks and the communications of federal government officials." ^{Footnote 20} Russia and China are among the most active state actors. Russian cyber threats gained public prominence in the context of the 2016 U.S. presidential election, when Russian intelligence organizations stole data from the campaign of Democratic candidate Hillary Clinton, leaked it through various websites, and used various means, including fake social media accounts, to spread propaganda and disinformation, and to amplify social tensions within the United States. Russian efforts to influence democratic processes in Europe and Africa came to light thereafter. In 2014, a Chinese state-sponsored actor infiltrated the National Research Council of Canada computer networks, causing significant costs for clean-up and remediation. Canada and other countries, including the United States and the United Kingdom, have negotiated agreements with China with the aim of reducing certain Chinese cyber espionage activities.

71. CSE has the primary responsibility for protecting Government of Canada networks from sophisticated cyber intrusions. CSE uses technologically advanced tools to protect government networks from attempts by malicious actors to access and infiltrate those networks. CSE regularly adapts its tools to respond to changes in the technologies and tactics used by those actors, and based on intelligence obtained through its collection efforts and that of its allies. CSE works with Shared Services Canada to secure government networks, and with Public Safety Canada to help protect information systems owned by other levels of government, critical infrastructure providers, and the private sector. On June 12, 2018, the federal government announced a consolidation of government cyber operational units into the Canadian Centre for Cyber Security, led by CSE. This consolidation includes the Canadian Cyber Incident Response Centre, which has operated in Public Safety Canada since February 2005.

Major organized crime

72. Major organized crime was another significant national security threat identified by the Privy Council Office to the Committee. Organized crime has become increasingly sophisticated and global. It is involved in traditional areas of criminality, such as drug trafficking, prostitution, and human smuggling, and more sophisticated forms of 'white collar' crime, such as money laundering, market manipulation, or identity theft. The impact of organized crime is significant and insidious: it undermines public safety, corrupts our legal and political systems, and threatens the integrity of our economy and financial systems.

73 The RCMP's Federal Policing Program employs approximately 5,000 investigators and over 1,000 specialized personnel to conduct investigations across a range of areas. The RCMP is the lead federal organization for investigating and disrupting major organized crime. RCMP investigators use a variety of tools to conduct their work, and may apply to courts for warrants to use the most intrusive techniques, such as intercepting personal communications. The RCMP works with other federal organizations, including CBSA, which is responsible for enforcing legislation related to immigration, customs, and strategic export controls, and the Financial Transactions and Reports Analysis Centre of Canada (more familiarly known as FINTRAC), which is responsible for assessing financial transaction reports and disclosing to the RCMP (and CSIS) financial intelligence that may support investigations of money laundering and terrorist financing. The RCMP also cooperates with Canadian police services and international partners, especially through the Five Eyes Law Enforcement Group and Interpol, to investigate crimes with an international dimension.

Weapons of mass destruction

74. The proliferation and potential use of weapons of mass destruction was another national security threat identified to the Committee. These weapons include nuclear, chemical, radiological, or biological weapons that could cause widespread and indiscriminate destruction. (*** This text cites an assessment and names a country that poses an increasing threat.***] The community is also concerned about foreign states trying to obtain civilian technologies - such as software used to encrypt telecommunications or sophisticated laser equipment ("dual use" technologies) and delivery systems subject to control lists or sanctions - that could be used to develop military technologies to threaten Canada and its allies.

75. The security and intelligence community works together to address the proliferation threat. For example, Global Affairs Canada is responsible for the administration of a number of laws designed to prevent the proliferation of weapons of mass destruction or the export of dual use technologies. Innovation, Science and Economic Development Canada is responsible for reviews of investments that may be injurious to national security under the Investment Canada Act. In each case, departments rely on the expertise and intelligence of organizations such as CSIS, CSE, DND, the RCMP, and Public Safety Canada to provide advice to ministers or to make decisions on specific export applications. The RCMP may also conduct investigations of individuals or companies suspected of violating Canadian laws in this area.

Promoting Canadian interests

76. Aside from addressing security threats, intelligence is used to advance Canadian interests in the areas of international relations, national defence, and national security. Canada is an active player on the world stage. It devotes considerable attention to building and maintaining bilateral relations with countries in key regions. It plays important roles in many multilateral organizations that focus on issues like trade and security. It deploys personnel around the world in support of Canadian foreign policy and security priorities, including peacekeeping and military missions, humanitarian and aid projects, or crisis situations that require support for Canadians abroad. In each of these circumstances, the government and its officials use intelligence to improve its understanding of a situation, develop the most appropriate or advantageous policies, and maximize the effectiveness of its operations.

77. A number of organizations collect and assess intelligence in support of these interests. CSE collects foreign intelligence in accordance with the government's foreign intelligence priorities. CSIS may collect intelligence within Canada relating to Canada's defence or international affairs at the request of the Minister of National Defence or the Minister of Foreign Affairs. lt may also report intelligence that it obtains in the course of a security investigation. CSE and CSIS intelligence reports are produced by personnel in each organization and provided on a need-to-know basis to specially cleared officials in over 20 government departments and relevant ministers through a highly classified communications network or through Client Relations Officers. Global Affairs Canada obtains privileged information through its personnel posted abroad and distributes its reports through a classified network. For its part, DND/CAF uses its intelligence capabilities to support forces deployed abroad (this will be discussed in greater detail in chapter 4).

78. A number of organizations write intelligence assessments for the use of a broad range of officials, including senior government officials and ministers. An assessment usually involves multiple sources of information or intelligence, including media reports, academic research, privileged contacts, metadata, or highly classified information from human sources or intercepted communications. Assessments may be used by policymakers and operational departments as contextual information, to support policy deliberations, or to refine or change operational programs. Strategic assessments of major international issues are developed by the Privy Council Office Intelligence Assessment Secretariat. Assessments of the threat posed by terrorism to Canada are done by the Integrated Terrorism Assessment Centre. CSIS develops and distributes assessments on security threats to Canada. CSE conducts assessments on cyber threats and cyber security, as they relate to federal government systems and information infrastructures of importance to the Government of Canada. Global Affairs Canada conducts assessments on threats to diplomatic missions. DND/CAF conducts a range of assessments on military issues, from tactical (to support deployed operations) to strategic (to support decision-making on military deployments).

Conclusion

79. Numerous departments and agencies comprise Canada's security and intelligence community. These organizations have diverse mandates and responsibilities, but work together to keep Canadians safe and to promote Canadian interests. The governance and cooperation of these organizations are managed through a number of specific committees that meet regularly to discuss operational and policy issues of common concern. Those organizations also cooperate and share information to varying degrees among themselves, depending on where their specific operational authorities and mandates may intersect. The following two chapters will review how the Government of Canada identifies and implements intelligence priorities, an important mechanism for the governance and accountability of Canada's security and intelligence community, and will review intelligence activities and authorities of DND/CAF, one of the security and intelligence community's core members. The Committee hopes that, together, this information will not only help to improve the effectiveness and accountability of Canada's security and intelligence community, but will also help Canadians better understand how the community functions and the specific activities of some of its key members.