DAOD 8002-1, National Counter-Intelligence Program

Table of Contents

1. Introduction
2. Definitions
3. Overview
4. Counter-Intelligence Investigations and Operations
5. Information Management
6. Responsibilities
7. References

1. Introduction

Date of Issue: 2003-03-28

Application: This is a directive that applies to employees of the Department of National Defence (DND) and an order that applies to officers and non-commissioned members of the Canadian Armed Forces (CAF members).

Approval Authority: This DAOD is issued under the authority of the Deputy Chief of the Defence Staff (DCDS).

Enquiries: Director General Intelligence (DG Int)/J2 Plans and Policy 4

2. Definitions

counter-intelligence (contre-ingérence)

Counter-intelligence means activities concerned with identifying and counteracting threats to the security of DND employees, CAF members, and DND and CAF property and information, that are posed by hostile intelligence services, organizations or individuals, who are or may be engaged in espionage, sabotage, subversion, terrorist activities, organized crime or other criminal activities.

security intelligence (renseignement de sécurité)

Security intelligence means intelligence on the identity, capabilities and intentions of hostile intelligence services, organizations or individuals, who are or may be engaged in espionage, sabotage, subversion, terrorist activities, organized crime or other criminal activities.

3. Overview

Context

3.1 The CAF National Counter-Intelligence Program (NCIP) is a centrally controlled series of activities designed to safeguard the security interests of DND and the CAF in or outside of Canada.

3.2 The NCIP is designed to assist the Deputy Minister (DM) and the Chief of the Defence Staff (CDS) in meeting their security obligations.

NCIP Mandate

3.3 The mandate of the NCIP is to:

1. identify and monitor threats to the security of DND and the CAF (see DAOD 8002-0, Counter-Intelligence, for a list of such threats);
2. direct the collection, collation and assessment of counter-intelligence (CI) security threat information at the national level to provide security intelligence, threat assessments and early warnings to DND senior managers and commanders;
3. provide a national level specialist CI unit to implement and co-ordinate NCIP CI security activities, including CI investigations and operations, based on national priorities; and
4. provide CI support to local DND managers, commanders and commanding officers (COs) in accordance with the objectives of the national program.

NCIP Activities

3.4 The following activities shall be provided as part of the NCIP:

1. security intelligence threat assessments in support of DND and CAF domestic and foreign interests and operations;
2. CI security investigations, operations and security briefings and debriefings to counter threats to, or to preserve, the security of DND and the CAF;
3. CI activities and products in support of the force protection responsibilities of commanders and COs;
4. coordination of security investigations into information operations (IO) activity targeting DND and the CAF;
5. liaison with Canadian police and security agencies and, as appropriate, with allied and host national military and civilian police and security authorities, where CAF members are or may be deployed, e.g., as part of an anticipated or actual United Nations deployment or in support of a NATO commitment;
6. the Security Intelligence Liaison Program (SILP) to provide early warning of potential threats against DND and CAF interests, and to support the preparation of the CAF for, and conduct in response to, requests for assistance during public welfare or public order emergencies under the Emergencies Act; and
7. the security screening of foreign persons attending DND and CAF programs in Canada.

NCIP Verification

3.5 J2/DG Int is responsible for overseeing the annual verification of the NCIP through a Counter-Intelligence Verification Team (CIVT) headed by J2 Plans and Policy 4. The CIVT shall consist of appropriately security cleared representatives from the Director Law/Operations (D Law Ops), DND and CAF Legal Advisor (LA) (as required) and Director Financial Operations (D Fin Ops) and Canadian Security Intelligence Service (CSIS).

3.6 The CIVT shall:

1. review all NCIP-related policies, doctrine, procedures, reports, memoranda of understanding (MOUs), duties and functions;
2. compile and analyze statistics on NCIP-related investigations and operations;
3. conduct annual verifications of CF National Counter-Intelligence Unit (CFNCIU) headquarters and CI Oversight Committee (CIOC) procedures, reports, duties and functions;
4. conduct investigations into allegations of inappropriate activities by the CFNCIU or National Defence Command Centre Security Intelligence (NDCC 2) associated with the NCIP. Allegation of illegal activities shall be referred for investigation to the Canadian Forces National Investigation Service (CFNIS);
5. make recommendations to J2/DG Int concerning the NCIP; and
6. provide a written report to J2/DG Int concerning each CIVT activity.

3.7 CIVT members shall have, as required, complete and unhindered access to all relevant CFNCIU and NDCC 2 files and records, except for Close Hold files, which shall not be verified until completion of the relevant investigation or operation. The Close Hold designation is assigned at the discretion of J2/DG Int.

3.8 Verification of DND and CAF CI activities during the course of a foreign deployment shall be as directed by J2/DG Int, with the concurrence of the DCDS. A final CIVT verification shall be performed upon completion of any foreign deployment.

3.9 All DND employees and CAF members shall report to the CIVT, wherever possible through the chain of command, any incident of inappropriate or illegal activity associated with the NCIP.

4. Counter-Intelligence Investigations and Operations

Overview

4.1 CI investigations are designed to identify and exploit information regarding the extent and nature of threats to the security of DND and the CAF, which may include special or sensitive debriefing initiatives.

4.2 CI operations are designed to:

1. conceal or deny information in order to protect DND employees and CAF members, and DND and CAF property or information, from threats to the security of DND and the CAF;
2. counter threats to the security of DND and the CAF; or
3. obtain details, as part of a covert operation or other counter human intelligence activities, about adversaries posing threats to the security of DND and the CAF.

4.3 CI investigations and operations shall focus on the threat to the security of DND and the CAF. Issues related to the criminality of an activity or event shall be referred to the civil or military police (MP) agency with jurisdiction for investigation.

4.4 CFNIS has overall DND and CAF responsibility for criminal intelligence, i.e., information relative to criminal activity that has been subject to the process of planning, direction, collection, evaluation, collation, analysis, reporting and dissemination. Criminal intelligence is used to:

1. reveal the existence of criminal organizations or other significant criminal activities;
2. identify the members of such organizations; and
3. establish their criminal activities, internal administration, movements, sources of income and vulnerabilities.

4.5 Prior to the authorization of any CI investigation or operation, DND and the CAF shall determine that:

1. the investigation complies with the law;
2. any investigative techniques used are related to the threat posed and the probability of its occurrence;
3. the need to use intrusive techniques is weighed against any possible breach of constitutionally protected rights and freedoms; and
4. the least intrusive techniques of information collection are used, taking into account the specific circumstance.

Investigations Outside Canada

4.6 In the conduct of DND and CAF CI investigations outside of Canada, all deployed DND employees and CAF members shall conform to Canadian law as well as respect the rights, obligations and restrictions imposed by the host nation's government.

Availability of Personnel

4.7 Subject to higher priority operational commitments, DND senior managers and commanders and COs shall ensure their subordinates are made available from their duties when required to assist with CI security investigations or operations.

Designation of Investigations

4.8 Active CI investigations and operations are designated as Level I, II or III according to the degree of intrusiveness. A preliminary assessment, which may be conducted under the authority of a CFNCIU Regional Counter-Intelligence Officer (CIO), is to be conducted in order to determine the potential requirement for an investigation or operation. Such an assessment includes a non-intrusive validation of the information received and confirmation of a DND or CAF nexus (see the Context block in DAOD 8002-0, Counter-Intelligence, for the meaning of "DND or CAF nexus" in respect of CI activities).

4.9 The preliminary assessment does not include the conduct of formal interviews. Should the assessment not support the requirement for an investigation or operation, the CIO shall report the circumstances to the CO, CFNCIU.

4.10 The tasking authority and procedure for each level of investigation or operation are set out in DAOD 8002-2, Canadian Forces National Counter-Intelligence Unit.

4.11 The levels of investigation or operation are determined as indicated in the following table:

Exceptional Circumstances

4.12 Exceptional circumstances may require action by the CFNCIU before authority for a Level I, II or III investigation or operation has been received. Under such circumstances, activities taken in support of the NCIP shall be as non-intrusive and limited as possible in keeping with protecting against a serious and present threat to the security of DND and the CAF. The appropriate authorization for these actions is to be obtained as soon as possible. A full report on the circumstances for such activities shall be forwarded to J2/DG Int within three calendar days.

Passive Activities

4.13 In addition to active CI investigations and operations, there are a number of passive activities that contribute to the security of DND and the CAF, such as defensive security briefings/debriefings and threat awareness programs.

4.14 Some passive CI-related activities do not fall under the lead of the NCIP, including:

1. physical security measures;
2. personnel security measures, such as security clearances; and
3. information technology security.

Other Circumstances

4.15 If a DND or CAF nexus exists but the subject of the investigation or operation is not a DND employee or CAF member, the lead agency is the civil, MP or security agency with jurisdiction.

4.16 While a CI investigation or operation may focus on the loyalty of a DND employee or CAF member, the responsibility for assessing loyalty rests with the DND manager or CO, and the Deputy Provost Marshal Security (DPM Secur).

4.17 A CI investigation or operation into the misuse or loss of classified equipment or material, or related to information operations or technology, is warranted only if there is a threat to the security of DND or the CAF.

Top of Page

5. Information Management

General

5.1 Information collected under the NCIP shall be managed carefully to preserve the integrity of the program and respect individual rights and the laws of Canada. To this end, the collection, storage and management of all CI, SILP and related CI reports and assessments shall be carefully controlled.

Collection of CI, Police and Security Information

5.2 In accordance with the NCIP, only the CFNCIU is authorized to investigate and collect information to support the SILP. This does not preclude DND senior managers, commanders and COs, or their staffs, from keeping abreast of the environment within their area of responsibility or their responsibility to establish open, harmonious working channels of communication with all elements of the public with whom they interact, including law enforcement and security agencies. However, the collection of security intelligence for integration into national or local threat assessments remains the primary responsibility of the CFNCIU.

5.3 Except for NDCC 2, which may gather security intelligence and information from police and security agencies in support of the threat assessment process, no other line or staff organization shall attempt to meet or communicate with law enforcement or security agencies to obtain security intelligence that is otherwise collected under the mandate of the SILP.

5.4 Routine security intelligence requirements to support a CAF regional commander's domestic planning are included in the annual National CI Standing Intelligence Requirements. New or specific local requirements consistent with the objectives of the NCIP may be referred to the CFNCIU in accordance with DAOD 8002-2, Canadian Forces National Counter-Intelligence Unit.

5.5 The CFNCIU is the DND and the CAF point of contact for security intelligence liaison and shall be included in all relevant meetings and activities.

5.6 A DND employee or CAF member who obtains information of potential security intelligence value in the performance of their duties shall provide the information to the CFNCIU.

Joint Intelligence Centre

5.7 During a domestic operation, the CFNCIU participates in any joint intelligence centre (JIC) formed to gather and share police or security information and intelligence. Through participation in the JIC, the CFNCIU is responsible for providing DND senior managers, commanders and COs, and their staffs, with the security intelligence needed to develop accurate security threat assessments.

Retention of CI Information and Intelligence Data

5.8 All information collected under the NCIP shall be retained in Information Bank Security Intelligence Records, DND PPU 060, established for purposes of the Privacy Act by DND and the CAF, and controlled and administered through J2 Plans and Policy.

5.9 Copies of CI information received from civil authorities and counter-intelligence assessment and reports generated by DND and CAF intelligence staffs or other DND or CAF entities shall be forwarded to CFNCIU HQ so that Access to Information Act obligations may be exercised centrally on behalf of DND and the CAF.

5.10 CFNCIU may retain CI information as authorized under DND PPU 060 and is responsible for access requests for matters under unit control. CFNCIU disposes of dated files or material no longer required for the unit in accordance with established administrative practices.

6. Responsibilities

Responsibility Table

6.1 The following table identifies the primary responsibilities for this instruction:

7. References

Acts, Regulations, Central Agency Poliies and Policy DAOD

• Government Security Policy
• DAOD 8002-0, Counter-Intelligence

Other References

• Access to Information Act
• Canadian Charter of Rights and Freedoms
• Canadian Security Intelligence Service Act
• Criminal Code
• Emergencies Act
• Privacy Act
• Security Offences Act
• DAOD 8002-2, Canadian Forces National Counter-Intelligence Unit
• DAOD 8002-3, Security Intelligence Liaison Program
• Information Bank Security and Intelligence Records, DND PPU 060.