Spy watchdog flags privacy risk from military’s online intelligence activities

OTTAWA — A national spy watchdog report says the military’s policy on the collection of information about Canadians doesn’t do enough to address the privacy risks posed by online searches.

The National Security and Intelligence Review Agency found the Defence Department and the Canadian Armed Forces have the legal authority to collect publicly available information from the internet for intelligence purposes, but the watchdog noted shortcomings on privacy protection and oversight.

The review agency said information that is publicly available online can still raise privacy concerns when it’s collected and analyzed by government organizations.

“Canadian law affords a high privacy interest to personal information that would tend to reveal the intimate details of the lifestyle and personal choices of an individual,” the report says.

“Canadians have a right to control how and to whom their personal information is communicated and to shield such information from unlawful intrusion by the state.”

Canadians should be able to trust that intelligence collection has a clear, lawful purpose and that their privacy rights are respected, the watchdog said.

It found the military does not systematically record the link between open-source collection activities on the internet and the approved operation or defence activity.

The watchdog also said policies and record-keeping do not adequately address all privacy risks or demonstrate that collection involving Canadians is necessary.

National Defence spokesperson Kened Sadiku said the department and the Canadian Armed Forces are reviewing the findings and recommendations, and assessing options to strengthen governance, policy and oversight where appropriate.

The review’s analysis focused on open-source intelligence gathering for approved operations or authorized defence activities from late February 2022 to the end of February 2025.

The military’s online collection activities related to the COVID-19 pandemic included personal information about Canadians that was not directly related to the purpose of the operation.

These activities, which have been widely reported in the media, raised concerns about the military’s online activities more generally, the spy watchdog report says.

The Defence Department and Canadian Armed Forces collect information online to maintain situational awareness about current events or specific developments and to address intelligence requirements, the watchdog notes.

“As an ever-expanding information environment, DND/CAF is steadily developing capabilities and expertise to collect from the internet.”

Military analysts use a variety of tools, including web browsers, other software applications and online databases, the report says. The military also relies on companies that collect and make available “vast amounts of information online, usually for a fee.”

Although the military has criteria to evaluate data providers, it has not consistently applied these criteria in all cases, the watchdog found.

For example, the military did not perform evaluations on 15 data providers that specialize in the collection of information about individuals, the report says.

“This may present policy and Charter risks, including infringing on the right to be secure against unreasonable search and seizure, as individuals may have a reasonable expectation of privacy in certain types of online information.”

This report by The Canadian Press was first published Nov. 4, 2026.

Jim Bronskill, The Canadian Press