Mission Focused: Confronting the Threat Environment

Signal Hill from across St. John’s Harbour, Newfoundland and Labrador.

CSIS investigates activities that fall within the definition of threats to the security of Canada, as outlined in the CSIS Act. Specifically, CSIS is authorized to investigate espionage and sabotage, foreign interference, terrorism and violent extremism, and subversion. Importantly, CSIS is prohibited from investigating lawful advocacy, protest, or dissent, except when it is carried out in conjunction with activities that constitute a threat to the security of Canada.

Duties and Functions

Investigate activities suspected of constituting threats to the security of Canada, report, and advise on these threats to the Government of Canada.
Take measures to reduce threats if there are reasonable grounds to believe the security of Canada is at risk.
Provide security assessments on individuals who require access to classified information or sensitive sites within the Government of Canada.
Provide security advice relevant to the exercise of the Citizenship Act or the Immigration and Refugee Protection Act.
Conduct foreign intelligence collection within Canada at the request of the Minister of Foreign Affairs or the Minister of National Defence.
Provide assessments by the Integrated Terrorism Assessment Centre (ITAC) that inform the Government of Canada’s decisions and actions relating to the terrorism threat.

All TRMs must comply with the Canadian Charter of Rights and Freedoms, and any TRM that would limit a right or freedom, or contravene any other Canadian law, requires a warrant issued by the Federal Court of Canada.

CSIS’ Role in National Security Investigations

While the RCMP and CSIS mandates are distinct, both agencies share an important goal: to address national security threats and ensure public safety. Given CSIS’ mandate, it will often have visibility on the emergence of the threat ahead of the RCMP. As established in the One Vision framework, CSIS and the RCMP regularly engage in dialogue to determine the most effective approach to address the threat. If it is determined that a criminal investigation and prosecution is the best approach, both organizations will collaborate in reducing the risk that sensitive CSIS information would be subject to law enforcement’s disclosure obligation. In 2023, CSIS information contributed to a number of important arrests in the national security space.

Vanessa Lloyd, Deputy Director of Operations at the Canadian Security Intelligence Service

Executive Spotlight – Deputy Director of Operations

Operating in an Increasingly Complex Threat Environment

Vanessa Lloyd, Deputy Director of Operations, is responsible for directing CSIS’ human intelligence collection, intelligence analysis, security screening and threat reduction efforts.

Ijoined CSIS in 1998 as an intelligence officer and have subsequently held operational and supervisory roles where I gained an awareness and appreciation of the breadth of threats facing Canada at home and abroad. Recently, I served as the organization’s first Chief Transformation Officer in charge of an ambitious agenda to equip CSIS as a forward leaning intelligence service better able to respond to current and future threats. I was appointed to the position of Deputy Director of Operations in the Spring of 2023, during a significant public discussion on foreign interference threats to Canada’s national security. These combined experiences inform my perspectives and current objectives in this role.

I can confidently state that since I joined CSIS, the threat environment has changed significantly. The environment of today is constantly evolving and increasingly complex. Rapid advancements in technology and artificial intelligence now provide hostile state actors and violent extremist organizations alike with capabilities never before thought possible. The proliferation of these technologies and increased volumes of data makes collecting and analysing intelligence in an increasingly digital world a challenge, and make the work of security intelligence professionals harder.

Increased global interconnectivity via the Internet and other digital spaces now allow threat actors outside of Canada’s geographic boundaries to influence, co-opt, and radicalize individuals without ever having to leave their country of origin and meet face-to-face. Greater online connectivity means that younger people are increasingly vulnerable to extremist rhetoric and ideas.

Never before have Canada’s diverse communities been so highly targeted by such blatant actions of foreign interference. However, this serious threat is not specific to Canada; our closest allies and fellow like-minded countries face the same malicious activities. Hostile state actors have become increasingly belligerent and emboldened to advance their objectives in both the physical and cyber realms, while seeking to silence those who challenge their narrative. They have more options and opportunities to conceal their threat activities, including by using criminal organizations as proxies.

Canada’s adversaries continue to target our talent and intellectual property to advance their espionage and proliferation objectives while national security concerns are increasingly relevant to the assessment of foreign investments in Canada, which could impact our country’s prosperity. While the Government of Canada seeks to provide opportunities for new beginnings, security assessments are the first line of defence against the exploitation of immigration pathways by threat actors.

In this threat environment, collaboration and partnerships between international and domestic security intelligence services and law enforcement agencies are more important than ever before in ensuring collective security and increasing CSIS’ ability to counter threats from all directions. Canadians can have confidence in CSIS’ commitment and ability to collaborate with partners to counter threats to domestic and international security.

How exactly did CSIS respond to the evolving threat environment in 2023? Those answers can be found within this year’s Public Report, which is our most comprehensive, threat-focused report released so far. It provides readers with overviews, assessments and awareness of how we protected Canadians and Canadian interests over the past year.

I hope that it will also provide insight into the efforts of CSIS employees who, with dedication and passion, investigate and reduce threats to Canadians and ensure that decision makers are informed of the many threats to Canada’s national security. ■

"Hostile state actors have become increasingly belligerent and emboldened to advance their objectives in both the physical and cyber realms in any way necessary, while seeking to silence those who challenge their narrative."

Vanessa Lloyd, Deputy Director of Operations at the Canadian Security Intelligence Service.

Foreign Interference and Espionage

Foreign interference and espionage activities in Canada continue to be pervasive, sophisticated, and persistent. Active targets of these activities include institutions at all levels of government, private sector companies and associations, universities, civil society groups, and diaspora communities within Canada.

The CSIS Act defines foreign influenced activities as “detrimental to the interests of Canada and clandestine or deceptive, or involve a threat to any person.” These activities are also commonly called foreign interference and are almost always conducted to further the interests of a foreign state, to Canada’s detriment. Malicious interference undermines Canada’s democratic institutions and public discourse; and it is used to intimidate or coerce diaspora communities in Canada. That is why it represents a threat to Canada’s social cohesion, sovereignty, and national security.

Foreign states engage in a variety of hostile activities such as elicitation, cultivation, coercion, illicit financing, malicious cyber activities, and information manipulation to interfere in Canada.

Major perpetrators of foreign interference and espionage in both Canada and the West include the People’s Republic of China, the Russian Federation, the Islamic Republic of Iran, and India. In 2023, these states and their intelligence services continued to engage in a variety of hostile foreign interference and espionage activities to advance their objectives and interests.

**Foreign Interference Techniques**
	Elicitation: Manipulating someone into sharing valuable and sensitive information through conversation.
	Cultivation: Building a strong friendship or relationship with someone to manipulate them into providing favours and valuable information.
	Coercion: Blackmailing or threatening someone to provide valuable and sensitive information or access.
	Illicit and Corrupt Financing: Using someone as a proxy to conduct illicit or corrupt financing on their behalf.
	Malicious Cyber Activities: Compromising electronic devices through various means including socially engineered emails, ransomware, and malware.
	Information Manipulation: Spreading false information on social media to amplify a particular message or provoke users to serve their own interests.

The People’s Republic of China

The People’s Republic of China (PRC) has one of the world’s largest and most active security and intelligence systems. Although primarily focused on ensuring the survival of the Chinese Communist Party (CCP), PRC Intelligence Services (PRCIS) actively carry out clandestine and covert activities targeting democratic states around the world, including the Government of Canada, provincial and territorial governments, Canadian citizens, and Chinese diaspora communities to advance the PRC’s national interests. The Ministry of State Security (MSS), China’s principal civilian human intelligence service, and other PRCIS apply a variety of methods, including leveraging social media platforms and offering financial incentives to recruit individuals to provide the PRC privileged or classified government or proprietary information. They also attempt to recruit individuals to spy on Canadians whose views challenge the narratives promoted by the CCP leadership.

In 2023, the PRC continued to expand the domestic powers and capabilities of its security services. Under President Xi Jinping, the PRC introduced a suite of national security laws that give its security and intelligence services extra-judicial and extraterritorial powers. These expansive laws elevate the risk of exit bans (a ban to prevent specific individuals from leaving China) or the arbitrary detention of anyone, including foreigners who live, visit, or work in the PRC. These laws also contain provisions, which give the PRC government the ability to control data in China, and to require PRC citizens anywhere in the world to assist and cooperate with China’s intelligence services in support of ‘national intelligence work.’

In 2023, the PRC and its intelligence services continued to harass and intimidate individuals in Canada who speak out against the CCP, thereby undermining fundamental Canadian democratic values. This form of foreign interference can include coercing a victim to return to the PRC or threatening their family members in China. The PRC largely targets those it perceives to pose a challenge to their ruling position, such as human rights activists, political dissidents, journalists, and members of religious and ethnic minority groups. The PRC engages in these activities with a view to shaping local and global narratives on the PRC. These activities can instill fear in affected diaspora communities, silence alternate voices, and trust in government institutions. In addition, the PRC has attempted to apply its National Security Law imposed on Hong Kong in 2020 extraterritorially by issuing warrants and bounties against Hong Kong activists currently in exile, including individuals with ties to Canada.

In addition to normal engagement activity by a foreign government in Canada, the PRC has employed grey-zone, deceptive, and clandestine means to attempt to influence Canadian policy-making at all levels of government (municipal, provincial, federal), Indigenous communities, and broader civil society (e.g., non-government organizations, media, academia, business, cultural). Such activity, which seeks to advance PRC national interests, has the potential to undermine Canada’s democratic process and its institutions.

Canada’s advanced economy and research expertise makes our country a target of malign PRC activities to advance its strategic, economic, and military interests at the expense of Canadian security and prosperity. The PRC has shown a particular interest in advanced technologies, such as artificial intelligence, quantum computing, biotechnology, and aerospace. The PRC has repeatedly shown that it is willing to use clandestine and deceptive means to acquire intellectual property and advanced technologies from Canada and its allies in order to give PRC companies a competitive and strategic advantage. In addition to traditional espionage, the PRC is actively attempting to recruit Canadians with desirable expertise through social media platforms and talent recruitment firms.

CSIS assesses that the PRC and CCP organizations will remain an enduring threat to Canadian information, technology, democratic institutions, and diaspora communities. The PRC will use a variety of methods, including public engagement, media outreach, and promotional campaigns, as well as deceptive and coercive tactics to affect Canada’s behavior and political attitudes in a way that advances its interests. The PRC’s negative perceptions of select Canadian domestic and foreign policy initiatives may also drive more foreign interference, disinformation efforts, and cyber activity in 2024.

The Russian Federation

The Russian Intelligence Services (RIS) continue to target Canadians for intelligence collection and collaboration. The RIS continue to be active globally, aiming to collect intelligence and conduct influence operations against NATO allies.

Canada’s steadfast support of Ukraine after the Russian invasion in February 2022 continues to make Canada a target for Russian disinformation and foreign interference activities. Russian officials and intelligence services have been actively spreading disinformation as part of a broader campaign to promote their narrative regarding the war in Ukraine, discredit the West, promote Russian influence, and push for an end to Western sanctions. Russia also continues to attempt to discredit Canada’s Ukrainian community, falsely claiming that it is composed of neo-fascists who control Canada’s foreign policy. Such narratives support the Russian government’s efforts to delegitimize and mute the views of Canada’s Eastern European diaspora communities and their status as Canadians, in support of Russia’s broader hybrid warfare against Ukraine. The Russian Embassy in Canada continues to use its social media accounts to spread disinformation regarding the conflict. Meanwhile, other groups in Canada and elsewhere who receive formal or informal direction from Russian government actors continue to amplify narratives to discredit Canada and its allies’ stance on Ukraine via traditional media, social media, and other platforms in the hope of influencing public opinion.

Social Media Post

Russia in Canada reposted

MFA Russia @mfa_russia Jan 1

Ukraine, which is infected with Nazism that has molded into terrorism, must be completely denazified and demilitarised.

The Kiev regime and its leaders, who worship the criminals of the Third Reich, will end up just like their idols.

Readers added context they thought people might want to know

This claim is baseless and is used by the Kremlin to “justify” their invasion of Ukraine.

The Islamic Republic of Iran

The Islamic Republic of Iran seeks to be a major power in the Middle East, spreading its influence to Iraq, Syria, Lebanon, and beyond. Its regional ambitions have been advanced primarily through an alliance with Syria and the use of Iran-aligned militias in Iraq, Lebanon, and Yemen. Efforts to obstruct Iran’s ambitions by the United States (US), Israel, and other regional states have led Iran to seek informal alliances with like-minded, anti-Western states like the Russian Federation. Iran has formed what it calls the “axis of resistance,” a regional alliance of Iran, Syria, Lebanese Hezbollah, alongside other non-state proxy actors. Since the October 7, 2023, Hamas attack against Israel, Iran has publicly praised the militancy targeting Israel and authorized its proxies and allies, including the Houthis in Yemen, to conduct attacks against Israel and US interests in Iraq and Syria.

Iran’s external operations in Western countries have been increasingly aggressive and expansive in recent years, resulting in numerous disruptions of lethal plots by security and law enforcement services in the US, the United Kingdom and in several European countries. Iran and its intelligence services are interested in influencing and clandestinely collecting information on the Iranian community, including anti-regime activists and political dissidents; human, women’s and minority rights activists; and fugitives wanted by the regime. Iran also targets Israeli and Jewish interests as part of its ongoing shadow war with Israel. Iran uses agents, proxies and sympathizers who may be witting or unwitting accomplices. In many cases, the objective is to silence criticism of the regime. In response to this threat, CSIS is actively investigating threats to life emanating from the Islamic Republic of Iran based on credible intelligence, as well as possible precursors to violence including harassment and intimidation from threat actors linked to Iran. Ultimately, these hostile activities undermine the security of Canada and Canadians, as well as Canada’s democratic values and sovereignty.

CSIS assesses that Iran will continue to target its perceived enemies even when living in foreign countries in support of its ultimate goal of regime preservation. Iranian threat-related activities directed at Canada and its allies are likely to continue in 2024, and may increase depending on regional developments and the Iranian regime’s own threat perceptions.

India

In September 2023, Prime Minister (PM) Justin Trudeau announced to the House of Commons that Canada’s security agencies were pursuing credible allegations of a potential link between agents of the Government of India and the killing of a Canadian citizen, Hardeep Singh Nijjar, in Surrey, British Columbia, in early June. The statement led to a deterioration of bilateral relations between Canada and India. Later in November, the US Federal Bureau of Investigation (FBI) unsealed an indictment describing an alleged murder-for-hire plot by an individual, Nikhil Gupta, whom the indictment alleges was conspiring with a Government of India official. The alleged target was a dual American-Canadian citizen residing in New York.

Prior to the PM’s September statement, Director Vigneault and then National Security Intelligence Advisor, Jody Thomas, travelled to India to discuss the matter with their counterparts. In response to the serious allegations, Director Vigneault stated that Canada and its allies require accountability from the Government of India concerning its potential involvement in the murder of a Canadian citizen on Canadian soil.

In January 2024, the Public Inquiry on Foreign Interference requested that the Government of Canada’s collection and production of documents include information and documents relating to alleged interference by India during the 2019 and 2021 elections.

Using Social Media to Warn Canadians

In June, CSIS published an advisory to Canadians, warning of PRCIS use of the social networking platform LinkedIn to detect, target, and recruit Canadians located inside and outside of China to engage in espionage. In November, CSIS published a security alert about hostile state actors recruiting Canadian researchers, academics, and experts for dubious international research placements and collaboration opportunities to facilitate economic espionage. In August, CSIS published a disinformation awareness campaign to foster public resilience against disinformation. Together these posts received over one million views across all social media platforms on which CSIS is active, indicating that social media is an effective tool for spreading awareness of hostile state activities targeting Canadians. ■

Disinformation Awareness Campaign Posters [Infographic]

Planting fears, is it working? Don’t be a pawn of disinformation. Don’t let it spread.
Clouded by disinformation? Don’t let it influence your view of reality.
Have you noticed trolls popping up? Be aware of what you share.
Do you know who is behind it? Disinformation is here and hides well.
Targeting Civilians on Canadian soil? Disinformation is on every screen, every doorstep.

CSIS Responds

In 2023, CSIS continued to detect, investigate, and reduce foreign interference and espionage threat activities perpetrated by hostile state actors. Highlighted activities include:

Collaborating with domestic security intelligence and domestic law enforcement partners to respond to and disrupt significant threat activities emanating from the Islamic Republic of Iran, particularly related to the development of lethal capability.
Collecting intelligence and providing advice to the Government of Canada to inform a whole-of-government response against threats to national security.
Conducting nearly 150 engagements with civil society partners to build resilience against foreign interference, espionage, and other hostile state activities.
Countering attempts by the PRC to gain access to Canadian classified and privileged information.
Decreasing the PRC’s ability to commit transnational repression through its overseas police stations by working in collaboration with domestic and international partners.
Disseminating intelligence products to Government of Canada partners to increase whole-of-government understanding of the foreign interference and espionage threats targeting Canada.
Providing over 200 security briefings to elected and unelected officials at all levels of government to build resilience against foreign interference and espionage.
Meeting with senior university administrators across Canada to build awareness of the extent of foreign interference activities, such as monitoring, intimidation, and harassment targeting international students on Canadian campuses.

Economic and Research Security

As a global leader in the research and technology sector, Canada is a prime target for foreign states seeking to acquire sensitive research and technologies to advance their own strategic political, economic, and military goals.

In a world marked by economic competition and confrontation, some states seek to advance their strategic political, economic, and military objectives by exploiting investment and trade with Canada. Foreign states seek to acquire access to or control over sensitive technologies, data, and critical infrastructure to advance their own military and intelligence capabilities, deprive Canada of access to economic gains, employ economic coercion against Canada, and support other intelligence operations against Canadians and Canadian interests. Such activities pose a threat to Canada’s national security and long-term economic prosperity.

The Investment Canada Act (ICA) sets out a national security review process to mitigate risks and review foreign investments on national security grounds. The national security review process is supported by Public Safety (PS) Canada and Canada’s security and intelligence agencies, including CSIS. In 2023, CSIS screened 1,010 ICA notifications for national security concerns.

In 2023, CSIS continued to protect Canadian innovation from state actor threats such as targeted investment, coercion, malicious cyber activities, espionage, and the use of collaborative and open research for nefarious purposes. The high-value targets of these threats are expertise, data, and intellectual property.

CSIS contributed to the Government of Canada’s research security agenda. To help protect Canadian research and industry, CSIS engaged numerous academic and research associations and companies in the emerging and sensitive technology sectors. CSIS aims to increase awareness of state-sponsored espionage threats targeting these sectors and lay the groundwork for reciprocal partnerships that will help protect Canadian research and development, and ensure Canadians and the Government of Canada have secure access to leading-edge and trusted technology. These briefings were delivered in support of the wider government research security effort, led by PS and Innovation, Science and Economic Development Canada (ISED), which has led to the creation of enhanced security guidelines for research partnerships in Canada.

CSIS worked closely with academic institutions across Canada to share information about national security threats to help safeguard Canadian research and information from economic espionage activities. In 2023, CSIS conducted in-person campus visits to over 13 Canadian academic institutions to engage with senior leadership and administration, faculty, and staff. During these visits, CSIS toured research facilities and laboratories to learn more about the sectors in which the institutions are international leaders to better inform CSIS’ ability to protect these complex sectors.

Prioritizing Research Security in the Five Eyes

In October 2023, Director Vigneault participated in the Emerging Technology and Securing Innovation Security Summit hosted by the FBI at the Hoover Institute at Stanford University in Palo Alto, California. The Summit brought together the principals of the domestic intelligence services of the Five Eyes (FVEYs) international intelligence alliance that includes Canada (CSIS), the United States (FBI), the United Kingdom (MI5), Australia (ASIO), and New Zealand (NZSIS) in their first ever joint public appearance. The FVEYs principals were joined by over 450 attendees, including private sector leaders, academics, and journalists. The principals addressed the threats posed to FVEYs economies by foreign states, particularly the PRC, that seek to illicitly acquire the competitive advantage held by FVEYs countries in critical and emerging technologies that include artificial intelligence (AI), quantum computing, and biotechnology.

During the event, the FVEYs principals participated in a discussion hosted by former US Secretary of State, Condoleezza Rice, hosted a press conference with journalists from each respective FVEYs country, and were interviewed for the US television program 60 Minutes. This historic engagement represents just one of the many steps CSIS and its FVEYs allies took in 2023 to generate greater public awareness of economic espionage threats and reduce its impact within the alliance. ■

"Innovation drives our collective prosperity and security, yet the threats to innovation are increasing in both scale and complexity. To meet this challenge, CSIS is working proactively with Five Eyes partners, private sector leaders, and academia to secure our future and to ensure the safety, security, and prosperity of Canada."

David Vigneault, Director of the Canadian Security Intelligence Service

Counter Proliferation

CSIS’ counter-proliferation efforts substantially reduce the risk of Canadian technology and products being utilized in the weaponry of adversarial foreign states.

The proliferation of chemical, biological, radiological, and nuclear weapons and their associated delivery vehicles constitutes a global challenge and a threat to the security of Canada and its allies. Several foreign states continue clandestine efforts to procure a range of sensitive, restricted, and dual-use goods and technologies in Canada, as well as expertise they may use to further their own weapons of mass destruction (WMD) programs and delivery vehicles.

CSIS actively investigates efforts by hostile state and state affiliated actors to illicitly procure sensitive technologies and goods in Canada. CSIS also continues to develop its robust understanding of foreign advanced conventional weapons and WMDs, and provide advice to the Government of Canada on sanctions against hostile states.

CSIS activities also include monitoring the development of emerging technologies, and their potential security implications. A prime example is the increasing involvement of private sectors in space technology. Advanced space technology used to be the exclusive domain of states, but due to scientific advancements and private sector capabilities, space platforms, products and services are increasingly available for purchase on the open market.

In its attempt to procure foreign technologies for its war effort against Ukraine, the Russian Federation continues to challenge Government of Canada export controls and sanctions. Russia applies a complex strategy to hide its involvement by falsifying shipping documents and by rerouting shipments through a vast network of intermediaries around the world.

Much like Russia, Iran continues its attempt to evade Government of Canada export controls and sanctions. CSIS engages with Canadian companies to prevent Iran’s procurement of technologies that are critical for the development of advanced conventional weapons. This collaboration has helped curb Iran’s ability to support destabilizing activities, such as providing weapons to Russia for its war in Ukraine and arming militia groups for attacks against Canadian and partner forces in the Middle East.

Government of Canada Efforts to Mitigate Technology Transfer

In late December 2023, a Federal Court judge upheld the decision by an immigration officer to reject a PRC national’s application for a Canadian study permit after concluding that the individual was inadmissible to Canada on security grounds. The officer believed that there were reasonable grounds to believe that the individual could be recruited or coerced by the PRC to engage in espionage activities against Canada or in contrary to Canada’s interests. The Chief Justice dismissed the judicial review application brought forward by the applicant in respect to that decision, upholding the decision made by the immigration officer that the applicant could engage in espionage given his expertise in a high priority research area for Beijing (biopharma and advanced medical products) and his association with a Chinese university linked to the PRC’s defence industry. These circumstances led both Immigration, Refugees and Citizenship Canada (IRCC) and the Federal Court to conclude that the PRC could utilize the applicant to engage in non-traditional collection activity to facilitate the unauthorized transfer of knowledge and technology from Canada to the PRC. The decision by IRCC and Federal Court is a significant decision in the context of safeguarding Canadian technology and intellectual property from likely applications in the PRC military industrial complex. ■

Cyber Threats

Canada’s strong democratic institutions, advanced economy, innovative research sectors, and leading academic institutions make Canada an attractive target for cyber-enabled espionage, sabotage, and foreign influenced activities, all of which pose significant threats to Canada’s national security.

CSIS’ Role in Cybersecurity

Working closely with trusted domestic and foreign partners, CSIS actively takes steps to investigate and reduce threats to the security of Canada posed by hostile cyber actors, including those in the PRC, Russia, and Iran. To do this, CSIS employs the entirety of its investigative techniques, including the use of dedicated human sources, warranted collection opportunities, and other covert methods. When appropriate, CSIS also takes steps to reduce threats to the security of Canada and Canadian critical infrastructure using its threat reduction mandate.

CSIS routinely provides high-quality intelligence assessments to our government partners, allowing them to make informed policy and operational decisions. CSIS also shares these assessments and investigative leads with our trusted foreign partners in order to assist them in ensuring the integrity of the global information infrastructure, upon which Canadian security relies.

In recent years, CSIS has also assumed a vital public facing role in the cyber domain as it conducts public and private sector briefings in order to alert Canadians to potential cyber vulnerabilities, and help them adopt best security practices. Such efforts help to harden the Canadian cyber ecosystem and reduce the attack surface for hostile actors. Direct briefings to targeted industry sectors, Indigenous groups, and governments, along with presentations and panel discussions at cyber industry and academic conferences, help Canada to remain alert to and resilient in an ever-growing cyber threat environment.

Cybersecurity and Geopolitics

The impact and connection of geopolitics and cybersecurity have become more evident and significant in recent years, as the digital environment has transformed the nature and conduct of warfare, espionage, diplomacy, and trade. Wars are now fought both in the physical and cyber realms. Events like Russia’s full-scale invasion of Ukraine and more recently the Israel-Hamas conflict have significantly amplified the need to prepare for the interconnected challenges presented by today’s geopolitical and cyber risks.

Throughout 2023, malicious cyber activity targeting Canada continued to increase in scale and complexity, as cyber threat actors sought to advance their economic, political, security, and ideological interests to the detriment of Canada and its allies. Cyber threat actors include state actors operating at the behest of nation-state intelligence services, and non-state actors, both of which aim to exploit weaknesses in information systems or individuals in order to gain unauthorized access to systems and networks. These threat actors are utilizing new technologies such as artificial intelligence (AI) to enhance the sophistication of their cyberattack capabilities.

Canada’s cyber threat environment is continuously changing and adapting with the development of new technologies. The constant evolution of the cyber threats targeting Canada demonstrates the need for continued cooperation throughout the Government of Canada and civil society to mitigate this complex and ever-increasing threat.

Ransomware

Ransomware, a malicious software that restricts access to or operation of a computer or device until a payment is received, continues to be one of the most impactful cyber threats to Canada and Canadians. Ransomware is primarily financially motivated, but states are increasingly leveraging criminal ransomware efforts for their own objectives. Threat actors target those with the largest possible impact, most notably, critical infrastructure, internet technology, and telecommunication systems. Hospitals in Canada were particularly targeted in 2023. While the financial damages have been severe, these attacks also resulted in loss of essential services and widespread loss of extremely sensitive data.

Ransomware is a low-cost tactic that also allows state actors to hide their involvement, as it is still largely considered to be a cybercriminal tool and law enforcement issue. States likely see value in collecting the intellectual property cybercriminals have stolen and, in some cases, states may perpetrate the activity, with or without interest in the payment, with the intention to obtain a target’s data. Leaks of proprietary information and personally identifiable information obtained through ransomware can be used to fuel foreign interference activities like harassment, extortion, and espionage. Such data can provide key pattern of life details, employment history, networks, and more, which can help a threat actor to focus their targeting efforts.

State-based Cyber Threats

The People’s Republic of China

PRC state cyber actors continue widespread cyber espionage against a range of sectors and targets within Canada, including government, academic institutions, private industry and civil society organizations. For example, PRC cyber actors have engaged in global mass exploitation campaigns leveraging software vulnerabilities to compromise hundreds of organizations using malicious emails. Every year, cybersecurity researchers discover major vulnerabilities in popular software or hardware products that can be exploited by hostile cyber actors. PRC cyber actors are also active in discovering new vulnerabilities unknown to the public (known as a zero day vulnerability). Even after public disclosure, many vulnerabilities often remain unremedied across all sectors so that even years old vulnerabilities are leveraged by the PRC.

In 2023, cyber actors, allegedly linked to the PRC, employed a network of social media bots to make allegations of criminal and immoral behaviour against Canadian politicians, ultimately attributing the allegations to a Canada-based Chinese-Canadian critic of the CCP. This campaign employed relatively new technologies such as deepfakes demonstrating one of the many ways in which new technology can be leveraged by threat actors.

This past year also saw a major shift in PRC cyber activity, as revealed by a joint FVEYs public disclosure in partnership with the private sector. This activity attributed to the PRC state actor Volt Typhoon, involved the targeting of critical infrastructure sectors in the US that support its military bases. This is the first public indication of the PRC targeting infrastructure of this scale. Sectors targeted ranged from telecommunications, energy, and transportation among others. Disruption in these sectors would impede military operations and have major impacts on civilian populations as well.

Further public disclosures have emphasised the role of compromised Small Office/Home Office (SOHO) devices in facilitating this targeting and the need to harden this type of infrastructure.

The Russian Federation

Russia has repeatedly demonstrated intent to display strength by conducting disruptive malicious cyber activities against strategic critical infrastructure targets of their adversaries. Russia also coordinates with non-state groups to conduct cyber threat activity against Ukraine and NATO allies, including Canada. In 2023, pro-Russian cyber actors conducted low sophistication, attention-seeking attacks against Canadian websites. These activities support Russia’s hybrid strategy as it aims to intimidate NATO allies and undermine their support for Ukraine. Russia-aligned cyber actors will almost certainly continue to conduct such easy-to-execute, low-cost, deniable cyber activities in the near term against Canada and other NATO allies.

Iran

Iran combines offensive cyber operations with cyber-enabled influence operations to assist in the pursuit of its geopolitical goals. While Canada is not a priority for Iran as compared to the United States and regional Middle East adversaries, most notably Israel, Canada remains a target for opportunistic credential harvesting, phishing attacks, and exploitation of digital infrastructure to facilitate future targeting opportunities against individuals of interest. Iran uses cyber extensively as a tool for the repression and manipulation of critics at home and abroad, including against Canada-based dissidents. Such practices, in combination with Iran’s control and manipulation of domestic communications platforms, limit the population’s ability to communicate and organize, and serves to uphold the regime’s hold on power.

India

Following the deterioration in the bilateral relations between Canada and India, low-sophistication cyber activities against Canada by India-aligned non-state cyber actors were observed. There is no indication that the Government of India was responsible for these cyber incidents.

**General Cyber Threat Activities**
	Distributed Denial of Service (DDoS) Flooding an Internet sever with Internet traffic to prevent users from accessing the server’s online services and sites.
	Phishing Deceiving or manipulating an individual into sending information or assets to a wrong recipient. A common phishing tactic is using fraudulent emails that appear legitimate to entice a user to click on a link containing a virus or to provide personal information.
	Credential Harvesting Stealing user login information such as usernames and passwords to illicitly access a victim’s account.

In response to the many cyber threats targeting Canada in 2023, CSIS continued to work with domestic and international partners to detect and reduce threats to national security. Additionally, CSIS engaged with civil society to build awareness and resilience against cyber threats. ■

Focus on Cyber: Navigating AI Technologies

Rapidly evolving AI technologies present opportunities and challenges to Canada’s national security.

The constant evolution of AI technologies has brought the subject to the forefront of conversations across government with private sector, academic, and community partners. AI enables people to work more efficiently by eliminating repetitive and mundane tasks, such as combing through an endless amount of data to search for something in the fraction of the time it would take a human.

In the realm of national security, AI presents both advantages and disadvantages. AI technologies can aid analysts and intelligence officers in their investigation into national security threats. AI capabilities deployed in the right way can be used to detect threats in real time and triage vast amounts of data to look for threat indicators, extremist behaviour, and foreign interference. However, the same advantages offered to CSIS from AI also create vulnerabilities, as both state and non-state threat actors will continue to learn and leverage the capabilities of this technology for malign purposes.

Malicious cyber threat actors are increasingly leveraging generative AI technologies to build and perfect their cyberspace toolkits. AI technologies can be used to conduct malign social engineering activities that facilitate the spread of disinformation online and manipulate targeted audiences towards perspectives or actions aligned with the propagator of the threat. One such technology that presents serious security challenges is deepfakes. Deepfakes are media manipulations, where images, voices, videos, or text are digitally altered or fully generated by AI. This technology can be used to falsely place anyone or anything into a situation in which they did not participate such as a conversation, activity or location.

As Canada’s adversaries continue to adopt AI technologies, malicious cyber activities targeting Canadian interests, critical infrastructure, public services, and economic security will only increase.

Developments in AI will make it easier for threat actors to create and propagate disinformation more difficult to identify as false. It is paramount that CSIS and its Government of Canada partners continue to adopt and integrate the technology in a responsible and ethical manner that respects Charter rights to ensure that those who seek to undermine national security and harm Canadians and Canada’s interests do not possess an advantage in this critical space. ■

Violent Extremism

Violent extremism, whether it is ideologically, religiously, or politically motivated, continues to pose a significant threat to Canada’s national security. Monitoring, investigating, and mitigating these serious threats are a key priority for CSIS and its national security community partners.

There are four categories of IMVE:

Xenophobic Violence, which includes racially-motivated and ethno-nationalist violence.
Anti Authority Violence, which includes anti-government and anti-law enforcement violence
Gender Identity Driven Violence, which includes violent misogyny (including incel movement), anti-2SLGBTQIA+, and anti-gender driven ideology violence.
Other Grievance Driven and Ideologically Motivated Violence

Key Ideologically Motivated Violent Extremist Events in 2023

Toronto Spa Attack Ruling: A Historic Decision

On February 24, 2020, a then 17-year-old minor entered the Crown Spa massage parlour in Toronto carrying a sword. He attacked and killed a female employee and injured two other individuals. The minor claimed to be part of the involuntary celibate (incel) community and openly espoused incel narratives. He also allegedly told attending paramedics that he intended to kill everyone in the building, stating, “I’m happy I got one.” During an examination of the minor’s laptop, police found images of both Alek Minassian, the 2018 Toronto van attack perpetrator, and Elliott Rodger, the ideological founder of the incel movement. The minor claimed that Minassian was an inspiration for his attack.

In late 2022, the minor subsequently pleaded guilty to first-degree murder and attempted murder. At the time, the plea did not include the associated terrorist charges against the accused. Ontario Superior Court judge Suhail Akhtar deliberated on whether the minor’s actions met the bar of terrorist activity as defined by s. 83 of the Criminal Code of Canada.

In June 2023, Justice Akhtar delivered his ruling, stating that the attack met the Criminal Code of Canada definition of a terrorist activity—motivated in whole or in part by incel ideology. On November 28, 2023, the perpetrator was sentenced to life in prison with no chance of parole for 10 years.

The ruling is significant as it provides, for the first time, greater clarity on the meaning of the term ‘ideological’ and concludes that the incel worldview constitutes an ideology for the purpose of terrorism offences. Further, this is the first time an accused in Canada has been found to have committed “incel-ideologically motivated terrorist activity.” Justice Akhtar cautioned, however, that not all incel cases will be crimes of terrorism.

The ruling also clarifies that the definition of terrorism does not require alliance to an organizational or group structure.

	What is the incel movement? The incel movement falls within the ‘gender/identity-driven violence’ category of IMVE. Involuntary celibates (Incels) are predominantly male online community adherents who define themselves by their inability to engage in sexual activities with women. Incels blame their inability to form sexual relationships on their own perceived genetic inferiority, their belief that women will only ever be attracted to the most attractive men, and perceived oppressive societal structures (e.g. feminism and political correctness). They blame women—and society as a whole—for their personal circumstances.

What is the incel movement?
The incel movement falls within the ‘gender/identity-driven violence’ category of IMVE. Involuntary celibates (Incels) are predominantly male online community adherents who define themselves by their inability to engage in sexual activities with women. Incels blame their inability to form sexual relationships on their own perceived genetic inferiority, their belief that women will only ever be attracted to the most attractive men, and perceived oppressive societal structures (e.g. feminism and political correctness). They blame women—and society as a whole—for their personal circumstances.

The Waterloo Attack: An Act of Anti-Gender Driven Violence

On June 28, 2023, Geovanny Villalba-Aleman, a 24-year-old recent University of Waterloo graduate, entered a Gender Studies class on campus and stabbed a professor and two students with a kitchen knife. He was subsequently charged with 11 offences including attempted murder and aggravated assault. On August 31, 2023, the prosecution announced its decision to prosecute Villalba-Aleman as a terrorist.

The attack appears targeted and while Villalba-Aleman held various ideological grievances, his primary motivation was likely his anti-gender views. The alleged perpetrator’s actions appear driven by a desire to express his grievances and send a message to his perceived enemies. CSIS assesses that the attack constitutes an act of IMVE and represents an example of anti-gender ideology violence.

CSIS assesses that the violent threat posed by the anti-gender movement is almost certain to continue over the coming year and that violent actors may be inspired by the University of Waterloo attack to carry out their own extreme violence against the 2SLGBTQIA+ community or against other targets they view as representing the gender ideology agenda.

While violent rhetoric itself does not equate or often lead to violence, the ecosystem of violent rhetoric within the anti-gender movement, compounded with other extreme worldviews, can lead to serious violence. CSIS assesses that exposure to entities espousing anti-gender extremist rhetoric could inspire and encourage serious violence against the 2SLGBTQIA+ community, or against those who are viewed as supporters of pro-gender ideology policies and events.

What is the anti-gender movement?
The anti-gender movement falls within the gender/identity driven violence category of IMVE and is defined as the ideological opposition to the socio-cultural shifts that are represented by the integration and acceptance of gender theory, including acceptance of the 2SLGBTQIA+ community.

Individuals may become engaged with the movement for many reasons, including beliefs stemming from misogyny, homophobia, transphobia, religious interpretations, conspiracy theories, or a generalized fear of socio-cultural change. While the movement may collectively hold extreme views, CSIS assesses that only a small portion of adherents are willing to engage in serious violence.

Major Ideologically Motivated Violent Extremist Arrests

On July 5, 2023, the RCMP arrested Patrick Gordon MacDonald, an Ottawa-based creator and propagator of neo-Nazi IMVE propaganda material. MacDonald produced graphic propaganda material under the alias ‘Dark Foreigner’ and had influence in the international neo-Nazi violent extremist movement. The Ottawa man was charged with participating in the activity of a terrorist group, facilitating terrorist activity, and commission of an offence for a terrorist group. In its statement, the RCMP commented that MacDonald’s arrest represented the first time in Canada “in which an individual advocating a violent far-right ideology has been charged with both terrorism and hate propaganda.”

On December 6, 2023, the RCMP arrested two Ontario men, Matthew Althorpe and Kristoffer Nippak, on terrorism charges for their alleged participation in the creation of manifestos and recruitment videos in support of the international neo-Nazi movement. Both men are alleged to have participated in the creation of Terrorgram collective manifestos and Atomwaffen Division recruiting videos. The Terrorgram collective is a group of online channels containing neo-Nazi ideology and manuals for carrying out racially-motivated violence, while the Atomwaffen Division is a listed neo-Nazi terrorist entity in Canada, Australia, and the United Kingdom that calls for violence against racial, religious, and ethnic groups among others to facilitate the collapse of society. CSIS provided the RCMP with assistance throughout this specific investigation, and CSIS intelligence was instrumental in leading to this outcome.

Religiously Motivated Violent Extremism

Religiously motivated violent extremism (RMVE) encourages the use of violence as part of a spiritual struggle against a perceived immoral system. Like other terrorist movements, RMVE actors utilize violence to intimidate or compel a desired action, or to restrain a government from taking an action.

The year 2023 saw the elimination of several key Daesh figures, including a former Caliph and individuals involved with planning terrorist attacks in Europe. While the removal of these key figures is an important factor in countering Daesh’s objectives, their deaths have no bearing on the group’s ability to inspire attacks. In April 2023, Daesh supporter Abdul Aziz Kawam was arrested for a stabbing attack on a bus in Surrey, British Columbia, and now faces four terrorism charges. More recently, Daesh supporters carried out attacks in Europe in October and December after Daesh called for violence in response to Quran burnings in Western countries. CSIS assesses inspired attacks across the globe will continue during 2024, at an unpredictable pace, related in part to world events, Daesh messaging, and the individual motivations of the attackers involved.

In 2023, the RMVE threat to Canada increased, as demonstrated by the rise in number of arrests in 2023. Domestic RMVE actors, primarily individuals or small groups inspired by Daesh, Al Qaeda (AQ), or the Israel-Hamas conflict can mobilize to violence quickly. These RMVE actors prefer to use low-sophisticated means against soft targets: a person or group, place, or thing that is easily accessible to the public and generally left unprotected.

In June, Zakarya Rida Hussein was arrested and accused of posting a Tiktok video that contributed to or facilitated terrorist activities for AQ and Daesh. Three minors, part of the same national security investigation, were arrested on terrorism-related charges, respectively in June, October and December. In December, Hussein pled guilty to one terrorism charge related to online recruitment for an attack planned during Pride month.

Anti-2SLGBTQIA+ and antisemitic rhetoric is spreading widely through social media and online forums among domestic RMVE adherents, increasing the risk of extremist violence against these communities, and placing youth vulnerable to RMVE propaganda at a higher risk of becoming radicalized on online platforms. Charismatic RMVE leaders in Canada continue to use international events to amplify their propaganda to radicalize and recruit vulnerable individuals while encouraging both domestic acts of violence and international travel to conflict zones. Consequently, CSIS assesses that RMVE actors will continue to pose a domestic threat to Canada in 2024.

CSIS assesses that RMVE is undergoing a generational shift that challenges conventional radicalization and mobilization pathways. Recently, there has been an increase of violent extremists holding highly personalized and at times contradictory ideologies, which they use to justify their acts of violence. Anonymous, permissive online environments have effectively lowered the age-related and societal gatekeeping barriers to extremism, such as parents and educators. RMVE supporters are currently the youngest in modern history, and a shift to leaderless, online radicalization has likely contributed to the development of the hybrid violent extremism ideological trend observed with today’s RMVE.

RMVE Arrests [Infographic]

2022: 6 RMVE Arrests

2023: 16 RMVE Arrests

166% increase

Canadian Extremist Travellers

Canadian extremist travellers (CETs) are individuals with an attachment to Canada through citizenship, permanent residency, or a valid visa and are suspected of having travelled abroad to engage in terrorism-related activities.
The current threat posed to Canada by CETs is religiously motivated.
CSIS is aware of a small number of Canadians who aspire to travel to join RMVE groups in the Middle East, Afghanistan, and Africa.
In 2023, six Daesh-affiliated CETs and their children returned to Canada from internally displaced persons camps in Syria.

Working in Partnership to Reduce the Violent Extremism Threat

CSIS continued to investigate the national security threat posed by violent extremism in 2023. For obvious reasons a majority of CSIS’ counter-terrorism operations must remain classified, however, CSIS was integral to the RCMP’s December arrest of an Ottawa youth who planned a terrorist attack in the nation’s capital. CSIS is proud to have contributed to this successful outcome, which prevented a potentially significant loss of life.

In response to the ongoing domestic and international threat posed by violent extremists, CSIS will continue to investigate and reduce the threat activities of extremists in collaboration with security intelligence and law enforcement partners to protect public safety. ■

Security Screening

Through its Government Security Screening and Immigration and Citizenship Screening programs, CSIS serves as the first line of defence against those who could threaten Canada’s national security by obtaining access to Canadian government information, research and data, or by seeking status in Canada via an immigration process.

As part of an overall evaluation to assist federal government departments and agencies in deciding to grant, deny or revoke security clearances, the CSIS Government Security Screening (GSS) program provides security assessments to help prevent individuals of concern from gaining access to classified or sensitive information, as well as sensitive sites such as airports, marine and nuclear facilities. The decision to grant, deny or revoke clearances ultimately rest with each department or agency, and not with CSIS. In 2023, CSIS received 146,000 requests for GSS.

The CSIS Immigration and Citizenship Screening (ICS) program provides security advice to the Canada Border Services Agency (CBSA) and Immigration, Refugees and Citizenship Canada (IRCC) regarding persons who may represent a threat to national security and are attempting to obtain entry to or status in Canada. In 2023, CSIS received 493,200 security screening referrals from IRCC and CBSA. IRCC takes CSIS’ advice into consideration when making a final decision on the inadmissibility of an applicant.

The Government of Canada has committed to the security screening of all adult asylum claimants. The volume of in-Canada asylum claimants (also known as Front End Security Screening) has rapidly increased over the last five years and continues to grow every year, creating pressures at ports of entry and leading to delays in process and other strains on the asylum system.

CSIS has played an integral role in the Canadian government’s humanitarian effort to resettle, in Canada, 40,000 Afghans fleeing conflict in Afghanistan. In the latter part of this effort, the focus of CSIS’ Afghanistan security screening program was on Afghans temporarily residing in Pakistan. This effort was defined by considerable urgency due to Pakistan’s stated intention of arresting or deporting (back to Afghanistan) thousands of displaced Afghans.

In early 2023, the federal government agreed to repatriate six Canadian women and their children whom Kurdish authorities had been holding in internally displaced persons camps, in Syria, owing to suspected membership in Daesh as Canadian extremist travellers (CETs). CSIS provided advice on the security threats posed by CETs and collaborated with the RCMP and the Public Prosecution Service of Canada in laying charges and peace bonds on returnees to mitigate potential threats to national security. In addition to the Canadian women, there were also non-Canadian mothers with Canadian children in these camps. CSIS’ immigration security screening team took an active role in assessing the risk that the non-Canadian women may pose to national security if granted Canadian status.

In late 2023, the intense fighting between Israel and Hamas raised the prospect of broader crisis in the Middle East. In response, the Government of Canada implemented measures to help Canadians and family members get to safety, including through assisted departures via the Rafah border crossing between Gaza and Egypt. CSIS has been engaged in vetting foreign nationals with ties to Canada who are escaping the conflict. ■

**Immigration and Citizenship Screening Program**
REQUESTS RECEIVED*	2023
Permanent Residents Inside and Outside Canada	21,600
Refugees (Front-End Screening**)	128,900
Citizenship	296,300
Temporary Residents	46,400
TOTAL	493,200

**Government Screening Program**
REQUESTS RECEIVED*	2023
Federal Government Departments	64,300
Free and Secure Trade (FAST)	8,100
Transport Canada (Marine and Airport)	55,300
Parliamentary Precinct	2,800
Nuclear Facilities	10,400
Provinces	100
Foreign Screening***	600
Special Events Accreditation	1,900
Others	2,500
TOTAL	146,000

*Figures have been rounded.

**Individuals claiming refugee status in Canada or at ports of entry.

***Security assessments to provincial and foreign governments, as well as to international organizations, when Canadians seek employment that requires access to sensitive information or sites in another country.

Integrated Terrorism Assessment Centre

The Integrated Terrorism Assessment Centre leverages all-source data, information and intelligence to deliver timely, rigorous and objective assessments that enable decision makers and security partners to safeguard Canadians and advance Canadian interests.

The Integrated Terrorism Assessment Centre (ITAC) is a both a functional analytical component of CSIS and a community resource. It operates under the provisions and authorities of the CSIS Act.

Integrated analysis is most pertinent to national security decision-makers in complex times. Today, intense intersections exist between terrorism, polarizing social issues, great power competition, food insecurity, and technological innovation.

ITAC strives to meet the needs of a range of clients, including the federal government, law enforcement and infrastructure partners through timely assessments published at multiple levels of classification. In 2023, ITAC received ministerial direction to begin assessing all national security threats to public officials.

	ITAC’s four lines of effort Reporting on terrorism threats, trends and events. Assessing and recommending the National Terrorism Threat Level for Canada. Assessing and setting terrorism threat levels for Canadian interests worldwide, including for special events and internationally protected persons. Developing strategic all-threat assessments for public officials.

2023 Trends and Looking Ahead

Following a surge in ideologically motivated violent extremism (IMVE) in 2022, and at the end of 2023, a rise in the prevalence of religiously motivated violent extremism (RMVE), ITAC assesses that an IMVE and a RMVE attack is equally likely to occur in Canada in 2024. In response, ITAC will continue to support departments responsible for risk mitigation measures.

A 2023 trend that will continue into 2024 concerns violent rhetoric and criminal activity targeting the 2SLGBTQIA+ community, Jewish and Muslim communities, public officials, and democratic institutions in Canada. ITAC assesses that the volume of online threats and violent propaganda propagated in 2024 will be exacerbated by conflict in the Middle East.

Over the course of 2023, the National Terrorism Threat Level remained at Medium, meaning that a violent act of terrorism could occur in the next 12 months. Canada has been at Medium since 2014.

Going into 2024, ITAC looks forward to celebrating its 20th anniversary and to continuing to provide services to safeguard Canadians and advance Canadian interests at home and abroad. ■

Page details

Date modified:: 2024-05-29

Language selection

Search