Mission Focused: Confronting the Threat Environment

1 Mission Focused: Confronting the Threat Environment

Signal Hill from across St. John’s Harbour, Newfoundland and Labrador.

CSIS investigates activities that fall within the definition of threats to the security of Canada, as outlined in the CSIS Act. Specifically, CSIS is authorized to investigate espionage and sabotage, foreign interference, terrorism and violent extremism, and subversion. Importantly, CSIS is prohibited from investigating lawful advocacy, protest, or dissent, except when it is carried out in conjunction with activities that constitute a threat to the security of Canada.

All TRMs must comply with the Canadian Charter of Rights and Freedoms, and any TRM that would limit a right or freedom, or contravene any other Canadian law, requires a warrant issued by the Federal Court of Canada.

Vanessa Lloyd, Deputy Director of Operations at the Canadian Security Intelligence Service

Executive Spotlight – Deputy Director of Operations

Operating in an Increasingly Complex Threat Environment

Vanessa Lloyd, Deputy Director of Operations, is responsible for directing CSIS’ human intelligence collection, intelligence analysis, security screening and threat reduction efforts.

Ijoined CSIS in 1998 as an intelligence officer and have subsequently held operational and supervisory roles where I gained an awareness and appreciation of the breadth of threats facing Canada at home and abroad. Recently, I served as the organization’s first Chief Transformation Officer in charge of an ambitious agenda to equip CSIS as a forward leaning intelligence service better able to respond to current and future threats. I was appointed to the position of Deputy Director of Operations in the Spring of 2023, during a significant public discussion on foreign interference threats to Canada’s national security. These combined experiences inform my perspectives and current objectives in this role. 

I can confidently state that since I joined CSIS, the threat environment has changed significantly. The environment of today is constantly evolving and increasingly complex. Rapid advancements in technology and artificial intelligence now provide hostile state actors and violent extremist organizations alike with capabilities never before thought possible. The proliferation of these technologies and increased volumes of data makes collecting and analysing intelligence in an increasingly digital world a challenge, and make the work of security intelligence professionals harder.

Increased global interconnectivity via the Internet and other digital spaces now allow threat actors outside of Canada’s geographic boundaries to influence, co-opt, and radicalize individuals without ever having to leave their country of origin and meet face-to-face. Greater online connectivity means that younger people are increasingly vulnerable to extremist rhetoric and ideas.

Never before have Canada’s diverse communities been so highly targeted by such blatant actions of foreign interference. However, this serious threat is not specific to Canada; our closest allies and fellow like-minded countries face the same malicious activities. Hostile state actors have become increasingly belligerent and emboldened to advance their objectives in both the physical and cyber realms, while seeking to silence those who challenge their narrative. They have more options and opportunities to conceal their threat activities, including by using criminal organizations as proxies.

Canada’s adversaries continue to target our talent and intellectual property to advance their espionage and proliferation objectives while national security concerns are increasingly relevant to the assessment of foreign investments in Canada, which could impact our country’s prosperity. While the Government of Canada seeks to provide opportunities for new beginnings, security assessments are the first line of defence against the exploitation of immigration pathways by threat actors.

In this threat environment, collaboration and partnerships between international and domestic security intelligence services and law enforcement agencies are more important than ever before in ensuring collective security and increasing CSIS’ ability to counter threats from all directions. Canadians can have confidence in CSIS’ commitment and ability to collaborate with partners to counter threats to domestic and international security. 

How exactly did CSIS respond to the evolving threat environment in 2023? Those answers can be found within this year’s Public Report, which is our most comprehensive, threat-focused report released so far. It provides readers with overviews, assessments and awareness of how we protected Canadians and Canadian interests over the past year. 

I hope that it will also provide insight into the efforts of CSIS employees who, with dedication and passion, investigate and reduce threats to Canadians and ensure that decision makers are informed of the many threats to Canada’s national security. 


"Hostile state actors have become increasingly belligerent and emboldened to advance their objectives in both the physical and cyber realms in any way necessary, while seeking to silence those who challenge their narrative."

Vanessa Lloyd, Deputy Director of Operations at the Canadian Security Intelligence Service. 

Back to Top

Foreign Interference and Espionage

Foreign Interference and Espionage

Foreign interference and espionage activities in Canada continue to be pervasive, sophisticated, and persistent. Active targets of these activities include institutions at all levels of government, private sector companies and associations, universities, civil society groups, and diaspora communities within Canada.

The CSIS Act defines foreign influenced activities as “detrimental to the interests of Canada and clandestine or deceptive, or involve a threat to any person.” These activities are also commonly called foreign interference and are almost always conducted to further the interests of a foreign state, to Canada’s detriment. Malicious interference undermines Canada’s democratic institutions and public discourse; and it is used to intimidate or coerce diaspora communities in Canada. That is why it represents a threat to Canada’s social cohesion, sovereignty, and national security.

Foreign states engage in a variety of hostile activities such as elicitation, cultivation, coercion, illicit financing, malicious cyber activities, and information manipulation to interfere in Canada.

Major perpetrators of foreign interference and espionage in both Canada and the West include the People’s Republic of China, the Russian Federation, the Islamic Republic of Iran, and India. In 2023, these states and their intelligence services continued to engage in a variety of hostile foreign interference and espionage activities to advance their objectives and interests.

Foreign Interference Techniques

Elicitation: Manipulating someone into sharing valuable and sensitive information through conversation.
Cultivation: Building a strong friendship or relationship with someone to manipulate them into providing favours and valuable information.
Coercion: Blackmailing or threatening someone to provide valuable and sensitive information or access.
Illicit and Corrupt Financing: Using someone as a proxy to conduct illicit or corrupt financing on their behalf.
Malicious Cyber Activities: Compromising electronic devices through various means including socially engineered emails, ransomware, and malware.
Information Manipulation: Spreading false information on social media to amplify a particular message or provoke users to serve their own interests.
Russia in Canada reposted  MFA Russia @mfa_russia Jan 1
Social Media Post

Russia in Canada reposted

MFA Russia @mfa_russia Jan 1

Ukraine, which is infected with Nazism that has molded into terrorism, must be completely denazified and demilitarised.

The Kiev regime and its leaders, who worship the criminals of the Third Reich, will end up just like their idols.

Readers added context they thought people might want to know

This claim is baseless and is used by the Kremlin to “justify” their invasion of Ukraine.

Using Social Media to Warn Canadians

In June, CSIS published an advisory to Canadians, warning of PRCIS use of the social networking platform LinkedIn to detect, target, and recruit Canadians located inside and outside of China to engage in espionage. In November, CSIS published a security alert about hostile state actors recruiting Canadian researchers, academics, and experts for dubious international research placements and collaboration opportunities to facilitate economic espionage. In August, CSIS published a disinformation awareness campaign to foster public resilience against disinformation. Together these posts received over one million views across all social media platforms on which CSIS is active, indicating that social media is an effective tool for spreading awareness of hostile state activities targeting Canadians.


Disinformation Awareness Campaign Posters [Infographic]
  • Planting fears, is it working? Don’t be a pawn of disinformation. Don’t let it spread.
  • Clouded by disinformation? Don’t let it influence your view of reality.
  • Have you noticed trolls popping up? Be aware of what you share.
  • Do you know who is behind it? Disinformation is here and hides well.
  • Targeting Civilians on Canadian soil? Disinformation is on every screen, every doorstep.

Back to Top

Economic and Research Security

Economic and Research Security

As a global leader in the research and technology sector, Canada is a prime target for foreign states seeking to acquire sensitive research and technologies to advance their own strategic political, economic, and military goals. 

Prioritizing Research Security in the Five Eyes

In October 2023, Director Vigneault participated in the Emerging Technology and Securing Innovation Security Summit hosted by the FBI at the Hoover Institute at Stanford University in Palo Alto, California. The Summit brought together the principals of the domestic intelligence services of the Five Eyes (FVEYs) international intelligence alliance that includes Canada (CSIS), the United States (FBI), the United Kingdom (MI5), Australia (ASIO), and New Zealand (NZSIS) in their first ever joint public appearance. The FVEYs principals were joined by over 450 attendees, including private sector leaders, academics, and journalists. The principals addressed the threats posed to FVEYs economies by foreign states, particularly the PRC, that seek to illicitly acquire the competitive advantage held by FVEYs countries in critical and emerging technologies that include artificial intelligence (AI), quantum computing, and biotechnology.

During the event, the FVEYs principals participated in a discussion hosted by former US Secretary of State, Condoleezza Rice, hosted a press conference with journalists from each respective FVEYs country, and were interviewed for the US television program 60 Minutes. This historic engagement represents just one of the many steps CSIS and its FVEYs allies took in 2023 to generate greater public awareness of economic espionage threats and reduce its impact within the alliance.


"Innovation drives our collective prosperity and security, yet the threats to innovation are increasing in both scale and complexity. To meet this challenge, CSIS is working proactively with Five Eyes partners, private sector leaders, and academia to secure our future and to ensure the safety, security, and prosperity of Canada."

 David Vigneault, Director of the Canadian Security Intelligence Service

Back to Top

Counter Proliferation

Counter Proliferation

CSIS’ counter-proliferation efforts substantially reduce the risk of Canadian technology and products being utilized in the weaponry of adversarial foreign states.

Government of Canada Efforts to Mitigate Technology Transfer

In late December 2023, a Federal Court judge upheld the decision by an immigration officer to reject a PRC national’s application for a Canadian study permit after concluding that the individual was inadmissible to Canada on security grounds. The officer believed that there were reasonable grounds to believe that the individual could be recruited or coerced by the PRC to engage in espionage activities against Canada or in contrary to Canada’s interests. The Chief Justice dismissed the judicial review application brought forward by the applicant in respect to that decision, upholding the decision made by the immigration officer that the applicant could engage in espionage given his expertise in a high priority research area for Beijing (biopharma and advanced medical products) and his association with a Chinese university linked to the PRC’s defence industry. These circumstances led both Immigration, Refugees and Citizenship Canada (IRCC) and the Federal Court to conclude that the PRC could utilize the applicant to engage in non-traditional collection activity to facilitate the unauthorized transfer of knowledge and technology from Canada to the PRC. The decision by IRCC and Federal Court is a significant decision in the context of safeguarding Canadian technology and intellectual property from likely applications in the PRC military industrial complex.

Back to Top

Cyber Threats

Cyber Threats

Canada’s strong democratic institutions, advanced economy, innovative research sectors, and leading academic institutions make Canada an attractive target for cyber-enabled espionage, sabotage, and foreign influenced activities, all of which pose significant threats to Canada’s national security.

General Cyber Threat Activities

Distributed Denial of Service (DDoS)
Flooding an Internet sever with Internet traffic to prevent users from accessing the server’s online services and sites.
Deceiving or manipulating an individual into sending information or assets to a wrong recipient. A common phishing tactic is using fraudulent emails that appear legitimate to entice a user to click on a link containing a virus or to provide personal information.
Credential Harvesting
Stealing user login information such as usernames and passwords to illicitly access a victim’s account.

In response to the many cyber threats targeting Canada in 2023, CSIS continued to work with domestic and international partners to detect and reduce threats to national security. Additionally, CSIS engaged with civil society to build awareness and resilience against cyber threats.

Back to Top

Focus on Cyber: Navigating AI Technologies

Focus on Cyber: Navigating AI Technologies

Rapidly evolving AI technologies present opportunities and challenges to Canada’s national security. 

The constant evolution of AI technologies has brought the subject to the forefront of conversations across government with private sector, academic, and community partners. AI enables people to work more efficiently by eliminating repetitive and mundane tasks, such as combing through an endless amount of data to search for something in the fraction of the time it would take a human.

In the realm of national security, AI presents both advantages and disadvantages. AI technologies can aid analysts and intelligence officers in their investigation into national security threats. AI capabilities deployed in the right way can be used to detect threats in real time and triage vast amounts of data to look for threat indicators, extremist behaviour, and foreign interference. However, the same advantages offered to CSIS from AI also create vulnerabilities, as both state and non-state threat actors will continue to learn and leverage the capabilities of this technology for malign purposes.

Fredericton, New Brunswick.

Malicious cyber threat actors are increasingly leveraging generative AI technologies to build and perfect their cyberspace toolkits. AI technologies can be used to conduct malign social engineering activities that facilitate the spread of disinformation online and manipulate targeted audiences towards perspectives or actions aligned with the propagator of the threat. One such technology that presents serious security challenges is deepfakes. Deepfakes are media manipulations, where images, voices, videos, or text are digitally altered or fully generated by AI. This technology can be used to falsely place anyone or anything into a situation in which they did not participate such as a conversation, activity or location.

As Canada’s adversaries continue to adopt AI technologies, malicious cyber activities targeting Canadian interests, critical infrastructure, public services, and economic security will only increase.  

Developments in AI will make it easier for threat actors to create and propagate disinformation more difficult to identify as false. It is paramount that CSIS and its Government of Canada partners continue to adopt and integrate the technology in a responsible and ethical manner that respects Charter rights to ensure that those who seek to undermine national security and harm Canadians and Canada’s interests do not possess an advantage in this critical space.


Back to Top

Violent Extremism

Violent Extremism

Violent extremism, whether it is ideologically, religiously, or politically motivated, continues to pose a significant threat to Canada’s national security. Monitoring, investigating, and mitigating these serious threats are a key priority for CSIS and its national security community partners.

There are four categories of IMVE:

  • Xenophobic Violence, which includes racially-motivated and ethno-nationalist violence.
  • Anti Authority Violence, which includes anti-government and anti-law enforcement violence
  • Gender Identity Driven Violence, which includes violent misogyny (including incel movement), anti-2SLGBTQIA+, and anti-gender driven ideology violence.
  • Other Grievance Driven and Ideologically Motivated Violence
What is the incel movement?
The incel movement falls within the ‘gender/identity-driven violence’ category of IMVE. Involuntary celibates (Incels) are predominantly male online community adherents who define themselves by their inability to engage in sexual activities with women. Incels blame their inability to form sexual relationships on their own perceived genetic inferiority, their belief that women will only ever be attracted to the most attractive men, and perceived oppressive societal structures (e.g. feminism and political correctness). They blame women—and society as a whole—for their personal circumstances.

What is the anti-gender movement?
The anti-gender movement falls within the gender/identity driven violence category of IMVE and is defined as the ideological opposition to the socio-cultural shifts that are represented by the integration and acceptance of gender theory, including acceptance of the 2SLGBTQIA+ community. 

Individuals may become engaged with the movement for many reasons, including beliefs stemming from misogyny, homophobia, transphobia, religious interpretations, conspiracy theories, or a generalized fear of socio-cultural change. While the movement may collectively hold extreme views, CSIS assesses that only a small portion of adherents are willing to engage in serious violence. 


Downtown Vancouver, British Columbia

RMVE Arrests [Infographic]

20226 RMVE Arrests

202316 RMVE Arrests

166% increase

Canadian Extremist Travellers

  • Canadian extremist travellers (CETs) are individuals with an attachment to Canada through citizenship, permanent residency, or a valid visa and are suspected of having travelled abroad to engage in terrorism-related activities.
  • The current threat posed to Canada by CETs is religiously motivated. 
  • CSIS is aware of a small number of Canadians who aspire to travel to join RMVE groups in the Middle East, Afghanistan, and Africa.
  • In 2023, six Daesh-affiliated CETs and their children returned to Canada from internally displaced persons camps in Syria.

Working in Partnership to Reduce the Violent Extremism Threat

CSIS continued to investigate the national security threat posed by violent extremism in 2023. For obvious reasons a majority of CSIS’ counter-terrorism operations must remain classified, however, CSIS was integral to the RCMP’s December arrest of an Ottawa youth who planned a terrorist attack in the nation’s capital. CSIS is proud to have contributed to this successful outcome, which prevented a potentially significant loss of life.

In response to the ongoing domestic and international threat posed by violent extremists, CSIS will continue to investigate and reduce the threat activities of extremists in collaboration with security intelligence and law enforcement partners to protect public safety.

Back to Top

Security Screening

Security Screening

Through its Government Security Screening and Immigration and Citizenship Screening programs, CSIS serves as the first line of defence against those who could threaten Canada’s national security by obtaining access to Canadian government information, research and data, or by seeking status in Canada via an immigration process.

As part of an overall evaluation to assist federal government departments and agencies in deciding to grant, deny or revoke security clearances, the CSIS Government Security Screening (GSS) program provides security assessments to help prevent individuals of concern from gaining access to classified or sensitive information, as well as sensitive sites such as airports, marine and nuclear facilities. The decision to grant, deny or revoke clearances ultimately rest with each department or agency, and not with CSIS. In 2023, CSIS received 146,000 requests for GSS.

The CSIS Immigration and Citizenship Screening (ICS) program provides security advice to the Canada Border Services Agency (CBSA) and Immigration, Refugees and Citizenship Canada (IRCC) regarding persons who may represent a threat to national security and are attempting to obtain entry to or status in Canada. In 2023, CSIS received 493,200 security screening referrals from IRCC and CBSA. IRCC takes CSIS’ advice into consideration when making a final decision on the inadmissibility of an applicant.

The Government of Canada has committed to the security screening of all adult asylum claimants. The volume of in-Canada asylum claimants (also known as Front End Security Screening) has rapidly increased over the last five years and continues to grow every year, creating pressures at ports of entry and leading to delays in process and other strains on the asylum system.

CSIS has played an integral role in the Canadian government’s humanitarian effort to resettle, in Canada, 40,000 Afghans fleeing conflict in Afghanistan. In the latter part of this effort, the focus of CSIS’ Afghanistan security screening program was on Afghans temporarily residing in Pakistan. This effort was defined by considerable urgency due to Pakistan’s stated intention of arresting or deporting (back to Afghanistan) thousands of displaced Afghans.

In early 2023, the federal government agreed to repatriate six Canadian women and their children whom Kurdish authorities had been holding in internally displaced persons camps, in Syria, owing to suspected membership in Daesh as Canadian extremist travellers (CETs). CSIS provided advice on the security threats posed by CETs and collaborated with the RCMP and the Public Prosecution Service of Canada in laying charges and peace bonds on returnees to mitigate potential threats to national security. In addition to the Canadian women, there were also non-Canadian mothers with Canadian children in these camps. CSIS’ immigration security screening team took an active role in assessing the risk that the non-Canadian women may pose to national security if granted Canadian status.

In late 2023, the intense fighting between Israel and Hamas raised the prospect of broader crisis in the Middle East. In response, the Government of Canada implemented measures to help Canadians and family members get to safety, including through assisted departures via the Rafah border crossing between Gaza and Egypt. CSIS has been engaged in vetting foreign nationals with ties to Canada who are escaping the conflict. 


North of Moose Jaw, Saskatchewan.

Immigration and Citizenship Screening Program
Permanent Residents Inside and Outside Canada 21,600
Refugees (Front-End Screening**) 128,900
Citizenship 296,300
Temporary Residents 46,400
TOTAL 493,200
Government Screening Program
Federal Government Departments 64,300
Free and Secure Trade (FAST) 8,100
Transport Canada (Marine and Airport) 55,300
Parliamentary Precinct 2,800
Nuclear Facilities 10,400
Provinces 100
Foreign Screening*** 600
Special Events Accreditation 1,900
Others 2,500
TOTAL 146,000

*Figures have been rounded.

**Individuals claiming refugee status in Canada or at ports of entry.

***Security assessments to provincial and foreign governments, as well as to international organizations, when Canadians seek employment that requires access to sensitive information or sites in another country.

Back to Top

Integrated Terrorism Assessment Centre

Integrated Terrorism Assessment Centre

The Integrated Terrorism Assessment Centre leverages all-source data, information and intelligence to deliver timely, rigorous and objective assessments that enable decision makers and security partners to safeguard Canadians and advance Canadian interests.

The Integrated Terrorism Assessment Centre (ITAC) is a both a functional analytical component of CSIS and a community resource. It operates under the provisions and authorities of the CSIS Act.

Integrated analysis is most pertinent to national security decision-makers in complex times. Today, intense intersections exist between terrorism, polarizing social issues, great power competition, food insecurity, and technological innovation.

ITAC strives to meet the needs of a range of clients, including the federal government, law enforcement and infrastructure partners through timely assessments published at multiple levels of classification. In 2023, ITAC received ministerial direction to begin assessing all national security threats to public officials.

ITAC’s four lines of effort
  1. Reporting on terrorism threats, trends and events.
  2. Assessing and recommending the National Terrorism Threat Level for Canada.
  3. Assessing and setting terrorism threat levels for Canadian interests worldwide, including for special events and internationally protected persons.
  4. Developing strategic all-threat assessments for public officials.

2023 Trends and Looking Ahead

Following a surge in ideologically motivated violent extremism (IMVE) in 2022, and at the end of 2023, a rise in the prevalence of religiously motivated violent extremism (RMVE), ITAC assesses that an IMVE and a RMVE attack is equally likely to occur in Canada in 2024. In response, ITAC will continue to support departments responsible for risk mitigation measures.  

A 2023 trend that will continue into 2024 concerns violent rhetoric and criminal activity targeting the 2SLGBTQIA+ community, Jewish and Muslim communities, public officials, and democratic institutions in Canada. ITAC assesses that the volume of online threats and violent propaganda propagated in 2024 will be exacerbated by conflict in the Middle East. 

Over the course of 2023, the National Terrorism Threat Level remained at Medium, meaning that a violent act of terrorism could occur in the next 12 months. Canada has been at Medium since 2014.

Going into 2024, ITAC looks forward to celebrating its 20th anniversary and to continuing to provide services to safeguard Canadians and advance Canadian interests at home and abroad. 

Back to Top

Page details

Date modified: