DND/CAF’s Open-Source Intelligence Needs a Canadian-Privacy Ledger

Public internet data still needs public safeguards when military intelligence is collecting it.

The National Security and Intelligence Review Agency has handed Ottawa a simple accountability test: if the military is collecting public internet information for intelligence, it must be able to prove why, under what authority, with what safeguards, and with what limits when Canadians’ information is involved.

NSIRA’s October 29 backgrounder on DND/CAF open-source intelligence is careful. It says the Department of National Defence and Canadian Armed Forces have legal authority to conduct these activities. That matters. National defence is real work, and publicly available information can be useful in modern operations. But authority is not the same thing as a blank cheque. The watchdog also found gaps in documentation, risk management, privacy protections and oversight.

Those gaps are not minor bookkeeping issues. NSIRA says collection activities were not consistently linked to approved defence operations or activities. It says risk assessments were not updated regularly and did not address all relevant risks. It says fifteen third-party providers specializing in collecting information about individuals had not been evaluated. It also says existing policies and recordkeeping did not adequately address all privacy risks or demonstrate that collection involving Canadians was necessary.

That should concern conservatives, civil libertarians and anyone who believes government power needs receipts. The fact that information is visible on the internet does not mean government can quietly pool, buy, analyze and retain it without a clear audit trail. Public posts, location clues, associations, images and scraped records can become something much more intrusive when aggregated by state agencies or purchased through private intelligence vendors.

The Liberal government’s answer cannot be: trust us, it is only open source. Canadians have already seen too many files where big promises about modernization, safety or national security arrived before the controls were visible. If DND/CAF can link each collection activity to an approved operation, publish the policy standard for doing so. If third-party data providers are safe and necessary, publish the evaluation framework. If Canadian information is protected, publish the handling, retention, deletion and audit rules.

NSIRA says it made five recommendations: better documentation, updated risk assessments, consistent provider evaluation, improved policies on collecting information about Canadians, and stronger records to support compliance monitoring. Those are basic governance expectations, not radical demands.

Parliament should also insist on a timeline. A watchdog finding is useful only if the department fixes the weakness, reports progress and lets reviewers test whether the fix actually changed practice. Otherwise, the same risks will be rediscovered in the next redacted report.

The conservative accountability position is straightforward. Defend Canada aggressively, but do not normalize a military data apparatus that cannot show its paperwork. A government that can track Canadians through open-source tools can also track its own approvals, risks, vendors, privacy reviews and deletion decisions.

Ottawa should publish a Canadian-privacy ledger for DND/CAF open-source intelligence before this quietly becomes another permanent black box.