Responses to NSIRA’s review: Review of Departmental implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2023: Mitigation and Armed Conflict
Read the report
Recommendation 1:
NSIRA recommends that departmental ACA risk assessments include thorough mitigation plans wherever a substantial risk of mistreatment is identified. These plans should:
- consider whether all mitigation measures proposed, taken globally, adequately address the specific risks alive in the case at issue and are capable of sufficiently lessening those risks;
- evaluate the reliability of any caveats and assurances proposed and weigh histories of compliance according to their quality;
- exclude any external considerations that are not relevant to the question of mitigation, including the risk of not sharing, and strategic or reputational considerations; and,
- include a plan to monitor for indications of mistreatment and adherence to caveats and assurances following an information exchange.
CSIS response
CSIS agrees with this recommendation.
CSIS agrees with the recommendation that risk assessments should include thorough mitigation plans. CSIS considers a range of measures to mitigate the risk of mistreatment, which is highlighted each year in the Avoiding Complicity in Mistreatment by Foreign Entities Act Annual Report. When it is assessed that a proposed disclosure to a foreign partner could give rise to a substantial risk of mistreatment, CSIS can consider a range of measures to mitigate the risk below the “substantial” threshold. Mitigation efforts can include obtaining updated human rights assurances from a foreign agency, placing caveats on information shared, and using a redacted version of the information (e.g., a form of words). CSIS also tracks the receipt of assurances received from each foreign agency, as well as instances where CSIS suspects that a foreign agency may not have adhered to such assurances or violated caveats.
CSIS’ Information Sharing Evaluation Committee (ISEC) also ensures CSIS remains compliant with the ACA Directions. ISEC is responsible for assessing and deciding on potentially high-risk information sharing requests by determining whether requests meet the “substantial risk” threshold and, if so, what mitigation measures may reduce the risk below that threshold.
CSIS also did a review of its processes and determined that CSIS followed all ACA Directions and sufficiently mitigated any risk of mistreatment when sharing information with a foreign entity.
Related finding(s)
Finding 1: NSIRA found that, in the cases examined, CSIS, GAC, RCMP, and IRCC’s mitigation determinations demonstrated common deficiencies, including:
- inadequate design of mitigation measures to address the specific risks of mistreatment present;
- insufficient assessment of caveats and assurances for clarity and reliability; and,
- improper incorporation of external considerations into the determinations of whether a substantial risk of mistreatment could be mitigated.
CSIS response
CSIS disagrees with this finding.
CSIS’ established protocols were followed when addressing potential mistreatment risks associated with information sharing, including internal review processes and risk mitigation measures.
Related finding(s)
Finding 2: NSIRA found that, in the examined case, CSIS may not have been in compliance with the ACA Directions, as they were unlikely to have sufficiently mitigated a substantial risk of mistreatment when sharing information with a foreign entity. Specifically, CSIS:
- relied upon caveats and assurances that were inadequately designed to address the specific risks of mistreatment present; and
- did not resolve substantial deficiencies that undermined the reliability of the caveats and assurances.
CSIS response
CSIS disagrees with this finding.
CSIS’ staff followed established protocols when evaluating the matter, including escalation for executive review. The responsible committee determined appropriate safeguards could mitigate risks, and CSIS implemented established risk mitigation procedures.
Recommendation 2:
NSIRA recommends that officials clearly document how each identified risk was mitigated prior to disclosing information to foreign entities.
CSIS response
CSIS agrees with this recommendation.
CSIS agrees with Recommendation 2, as it has comprehensive policies and procedures in place to ensure that risk mitigation is documented. CSIS routinely reviews and improves its processes to ensure rigorous compliance with the ACA Directions.
These comprehensive policies and procedures ensure mitigation measures are taken prior to disclosing information to a foreign agency, including for those involved in armed conflict. CSIS also tracks the measures employed to mitigate risks, such as human rights assurances.
As required in the ACA and related Order in Council, if a substantial risk of mistreatment cannot be mitigated, the information is not shared. The ACA Directions do not allow for humanitarian purposes to be part of the decision-making process when assessing the risk of mistreatment and whether such a risk can be mitigated.
Related finding(s)
Finding 7: NSIRA found that a foreign country’s involvement in armed conflict created challenges for departments in meeting their mitigation obligations under the ACA Directions when seeking to share information with that country’s entities.
CSIS response
CSIS disagrees with this finding.
CSIS disagrees with the characterization. CSIS followed its established risk mitigation protocols that incorporated conflict-related considerations, and these did not impede its ability to fulfill regulatory obligations.
Related finding(s)
Finding 8: NSIRA found that the practical realities of compliance with the ACA Directions can, in certain circumstances, create a dilemma for departments seeking to share for humanitarian purposes.
CSIS response
CSIS disagrees with this finding.
CSIS disputes the finding that this reflects its operational reality. While recognizing the humanitarian values shared by its personnel, CSIS maintains that its policies explicitly exclude humanitarian considerations from risk assessments and mitigation determinations.