National Defence

National Defence Headquarters Ottawa, Ontario K1AOK2

Defense Rationale

Our file: A-2012-01720

SEP

4 2013

Mr. Jack Julian CBC Radio News P.O. Box 3000 1740 Bell Road Halifax, Nova Scotia B3J 1L2 Dear Mr. Julian: This is further to your request submitted under the Access to Information Act for: Briefing notes and lessons-learned reports held by CD1, SJS, ADM-POL, CDSandCFNIS, related to the case of a named CF member for the period Sept. 1, 2011 to Nov. 1, 2012. Enclosed please find all requested records that could be located using the Department's best efforts, within the constraints of the Act. You will note that certain information has been withheld from disclosure pursuant to sections 15(Defence and International Affairs), 19, 21, and 23 of the Act. Also, please note, that all records held by CFNCIU (under GDI) have been withheld in full pursuant to section 16 of the Act as they relate to ongoing investigations. Please be advised that you are entitled to file a complaint with the Office of the Information Commissioner concerning the processing of your request within sixty days of the receipt of this notice. In the event you decide to avail yourself of this right, your notice of complaint should be addressed to: Office of the Information Commissioner Tower B, Place de Ville 112 Kent Street, 22nd Floor Ottawa, Ontario K1A1H3 We also wish to advise you that the Department of National Defence (DND) complies with the Treasury Board Secretariat Guide for Posting Summaries of Completed Access to Information Requests. Summaries of DND requests can be found on our website www.forces.gc.ca under the tab "Completed Access to Information Requests". Should you require clarification or assistance regarding your request, please contact Curtis Mathews of my staff at (613) 995-8410 or by e-mail at curtis.mathews(g>,forces.gc.ca or use our toll free number 1-888-272-8207. Yours truly,

Julie Jansen Director Access to Information and Privacy Enclosure: Release Copy

Canada

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATION OWULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

Strategic Joint Staff Director Arms Control VerlfipdTVon

ftat-rnajor Interarmtas strategique Di recta ur Verification du contrdle dee armements

DOS

/MAT REPORT V, " ~ 1. 2. As directed, the subject report, updated to 28 Sep, is submitted herein. Given the volume of associated materials, please note the following: a. annexes to the report contain only essential elements of key information and/or account of activity with which SIMAT was directly involved in terms of coordination/overwatch; and higher classification or external-sourced documents are accounted for as referenced materials (released under SEPCOR) under Annex G.

b.

3. As an end-month submission, publication of this report in early October is timely; given the resumption of formal judicial proceedings on 10 Oct. 4.
V/R

For consideration.

ns D.S. Col SJS DACV 995-2511

1 Oct12

SECRET

A0383244 1-A-2012-01720 - 1

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION WyULGyjEN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET
National Defence Strategic Joint Staff Director of Staff National Defence Headquarters Ottawa, Ontario K1AOK2 2100-1 (SIMAT) / October 2012 Defense nationale Etat-major interarmees strategique Directeur de I'etat-major Quartier general de la Defense nationale Ottawa, (Ontario) K1AOK

S15(1)

Distribution List

REPORT SECURITY ISSUE MANAGEMENT ACTION TEAM (DELISLE CASE) References: A. 2100-1 (SJS DACV) Director of Staff Initiating Directive - Security Issue Management Action Team (Delisle Case) 27 January 2012 B. 2100-1 (SIMAT) VCDS Initiating Directive - Interdisciplinary Task Force on Detected Security Breach - Op ATHENA Info Mgt Repatriation 26 March 2012 C. SIMAT Report 28 September 2012 (enclosed) 1. Since its establishment at Reference A, the Security Issue Management Action Team (SIMAT) has served as the Department's principal ad hoc oversight mechanism through which overarching coordination and adjudication of any and all matters pertaining to the Sub-Lieutenant J.P. Delisle case, together with other security-related issues, have been undertaken on a continuous basis. 2. Under its assigned terms of reference, SIMAT has provided situational awareness from all sources, while coordinating and otherwise facilitating the formulation, development and promulgation of detailed guidance and specific courses of implementation within the Department and Canadian Forces. It has also served to assist and support, where appropriate, inter-departmental and other external efforts pertaining to security-related matters. In all respects, SIMAT has served as an interim body only, pending the establishment of new or modified mechanisms as part of an evolved departmental security issue management apparatus. 3. By design, SIMAT methodologies have been rudimentary in nature, entailing the initial identification of a given security issue, from which a process of analysis, evaluation, coordination, recommended action implementation, monitoring and follow-up assessment can be undertaken. In this respect, SIMAT has not been assigned specific oversight; rather, it has served as a channel through which to enable applicable OPIs to more effectively discharge existing responsibilities or assume new functions, as determined by higher authority. Indeed, given the highly complex and technical nature of several attendant security matters, the establishment of tangential staff mechanisms has been required in some instances. Such was the case with the stand up of the adjunct Interdisciplinary Task Force on Detected Security Breach (Operation ATHENA), which has undertaken specific, concerted actions to localize, contain and mitigate the effects of a security incident pertaining to that operation. 4. Overall, SIMAT and corresponding matrixed activities have proven reasonably effective as an overall provisional approach to detecting and identifying security issues and subsequently providing the characterization, analysis and assessment required to 1/2

Canada
SECRET

A0383244 2-A-2012-01720-2

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSBGNEMFJUTS NON OASSIFIE1

SECRET enable senior-level decision making, coordinated action, monitoring, tracking and records management. Nevertheless, SIMAT's mandate will effectively lapse with the resumption of formal judicial proceedings against Sub-Lieutenant Deiisle, along with the progression of the Departmental Security Transformation Initiative. This initiative, established by VCDS, will improve security functions within National Defence through the development of a viable and sustainable Departmental Security Plan, pursuant to the Policy on Government Security and consistent with the Government's Safeguarding Initiatives Task Force. Accordingly, given the Departmental Security Officer's current cochairmanship, SIMAT functions will be effectively assumed by the Senior Security Advisory Committee, concurrent with that body's increased executive oversight within an evolved Defence Security Programme. 5. The enclosed report, which provides a synopsis of SIMAT-administered security issues, coordinated staff actions and associated outcomes, is enclosed. Please address any queries on individual issues contained within the report to the corresponding OPI or the SI MAT Co-Chairs: a. b. Colonel R.M. Lander, Departmental Security Officer, 613-943-7542, Rod. Lander forces.qc.ca: and Colonel D.S. Higgins, Director Arms Control Verification, 613-995-2511, David.Hiqqins forces.qc.ca.

Major-General Enclosure: 1 Distribution List Action SJS J3 Comd Canada COM Comd CEFCOM Information CDS DM VCDS MNDO ADM(Fin CS) ADM(S&T) DND/CF LA CRS DComd NORAD CANMILREP NATO CANMILREP PRMNY Comd CDLS(W) Comd CDLS(L) SIMAT

Comd CANSOFCOM Comd CANOSCOM

C Naval C Army C Air Force ADM(IM) ADM(IE) ADM(Pol) ADM(PA) CDI JAG CMP ADM(HR-Civ) 2/2 SECRET

A0383244 3-A-2012-01720 - 3

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET,

DEPARTMENT OF NATIONAL DEFENCE Strategic Joint Staff

Security Issue Management Action Team

REPORT- SUB-LIEUTENANT J.P. DELISLE CASE 28 September 2012

SECRET,
A0383244 4-A-2012-01720 - 4

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATION DMJLGU EN VERTU DE LA LAI - RENSBGNEMENTS NON OASSIFII

SECRET/

s - 15 < 1 >

FOREWORD Particulars associated with the investigation and subsequent prosecution of Sub-Lieutenant J.P. Delisle under the Security of Information Act and Criminal Code of Canada, following allegations of having communicated information to a foreign entity without lawful authority, have resulted in extensive efforts to contain, resolve or otherwise mitigate extant and potential vulnerabilities within the security and intelligence apparatus of the Department of National Defence. Concurrent with the transfer of departmental oversight of the Delisle case from the Chief of Defence Intelligence, the Security Issue Management Action Team (SIMAT) was established by the Director of Staff, Strategic Joint Staff, as the principal body through which specific concomitant responsibilities would be discharged on his behalf. Accordingly, SIMAT has served as the principal provisional staff mechanism through which departmental coordination, facilitation and management of issues associated with the Delisle case, along with other specific security matters warranting similar strategic-level adjudication, have been addressed, pending the transition to an ameliorated security issue management cycle. With representation from principal Level 1s, SIMAT has promulgated strategic awareness from all sources, provided analysis and recommendations to senior decisionmakers, coordinated resultant decisions/directives and maintained records of associated documents, proceedings and other materials. The enclosed report provides an overview of SIMAT-administered security issues and coordinated staff actions, outcomes and current status during the period 27 January to 28 September 2011. Detailed accounting of individual issues and actions undertaken has been duly provided in corresponding reports, returns and other documentation attributable to the applicable Offices of Primary Interest, within their corresponding jurisdictions.

D.S. Higgifis Colonel Co-Chair

R.M. Lander Colonel Co-Chair

Security Issue Management Action Team (SIMAT)

SECRET
A0383244 5-A-2012-01720 - 5

RELEASED UNDER THE AIA - UNCLASSIREDINFORMATION DIVULGUE EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

SECRET

TABLE OF CONTENTS SECTION ONE-INTRODUCTION BACKGROUND 1 1

AIM
SCOPE SECTION TWO - ANALYSIS AND ASSESSEMENT DAMAGE ASSESSMENT OPERATIONS Synopsis Evaluation/Analysis Determinations Action Implementation Lessons Learned Business Continuity Planning (BCP) FORCE PROTECTION General Reaction within GOC Security and Counter-intelligence Investigations Poor Security Practices 'Summary INTELLIGENCE INFORMATION MANAGEMENT Synopsis Evaluation/Analysis Determinations Action Implementation Lessons Learned DEPARTMENTAL SECURITY Security Clearance-Related Shortfalls INVESTIGATION

1
1 2 2 3 3 3 4 4 5 5 5 5 6 6 7 7 7 8 8 8 9 9 9 10 10 11

SECRET
A0383244 6-A-2012-01720 - 6

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

s.19(1)

LEGAL PROCEEDINGS Synopsis Option to Transfer to the Military Justice System Current Situation POLICY Parliamentary Queries PUBLIC AFFAIRS/COMMUNICATIONS Public Affairs Concept of Operations Public Affairs Approach Public Affairs Coordination Media Synopsis PERSONNEL Welfare of and Support to Sub-Lieutenant Delisle Synopsis of Personnel Support to Sub-Lieutenant Delisle and Dependants Status of Dependants Divisional System

11 11 11 12 12 12 12 13 13 14 14 14 15 15 15 16 17

17 18
Evaluation/Analysis Determinations Action Implementation SECTION THREE - CONCLUDING MATERIAL SIMAT CO-CHAIR DEDUCTIONS AND DETERMINATIONS ANNEXES:............. 19 19 19 20 20 .......21

in SECRET//CAN/USA LIMDIS
A0383244 7-A-2012-01720 - 7

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION WyULGylENVERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET;

REPORT SECTION ONE - INTRODUCTION BACKGROUND 1. (U) In January 2012, Sub-Lieutenant Jeffery Paul Delisle was arrested and charged under the Security of Information Act and Criminal Code of Canada for having allegedly communicated information deemed harmful to the national interest to a foreign entity between July 2007 and January 2012. In 2010, Sub-Lieutenant Delisle was assigned at both the Chief of Defence Intelligence and the Strategic Joint Staff. His last posting was HMCS TRINITY, Halifax, where he had access to intelligence related to Canadian Forces plans and operations, in addition to intelligence and other information concerning Allies and countries of interest to Canada.
AIM

2. (S, This report provides an overview of activities undertaken through the Security Issue Management Action Team (SIMAT), as directed by the Director of Staff Strategic Joint Staff (DOS SJS), following the discovery of alleged espionage activity by Sub-Lieutenant Delisle and ensuing determinations concerning deficiencies in departmental security. Generally speaking, SIMAT activities have constituted a provisional approach to the oversight and management of subsequent efforts to detect, contain, resolve or otherwise mitigate the deleterious effects of this alleged activity, along with related systemic faults, within the Department of National Defence, other Government departments, Allies and individuals. SCOPE 3. (S/ As directed by DOS SJS, SI MAT'S efforts have focussed upon any and all matters pertaining to departmental security management attributable to or resulting from the aforementioned security breach, employing a process of issue identification, management, analysis, evaluation, action, implementation/coordination and monitoring/review. This report therefore provides an account of the issues identified and analyzed by SIMAT and its constituents, with a view to detecting and characterizing specific concerns, coordinating action to isolate associated impairment and determining and recommending courses of action to address any identified associated security faults. The report also provides some insight concerning the manner in which the CF has engaged Sub-Lieutenant Delisle's family as affected individuals, along with broader considerations pertaining to measures required to re-establish/reinforce the fundamental integrities of the Defence Security Programme.

REPORT-1/21 SECRET
A0383244 8-A-2012-01720 - 8

RELEASED UNDER TtHE AIA - UNCLASSIFIED INFORMATION DIVULGU EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFII

SECRET)

S'15(1)

SECTION TWO - ANALYSIS AND ASSESSEMENT DAMAGE ASSESSMENT 1. (C. A Damage Assessment Team (DAT) was assembled by the Chief of Defence Intelligence (GDI) following the arrest on 13 Jan 2012 of Sub-Lieutenant J.P. Delisle on suspicion of unlawfully passing classified information to agents of a foreign entity; namely, the Russian Federation. 2. (Si The GDI DAT was formed under BGen R.S. Williams on 1 Feb 2012. Its mandate was to gather, collate and analyze all available data connected to Delisle's access to sensitive information, and present its findings to GDI.

3. (S,

4. (S

5. (S

6. (S,

REPORT - 2/21 SECRET;

A0383244 9-A-2012-01720 - 9

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION PIVULGUE EN VERTU DE LA LAI - RENSFJRNEMENTS NON CLASSIFIED

SECRET

OPERATIONS Synopsis

1. (S/

2. (Si

3. (S

4. (S/ GDI conducted its investigations and initial damage assessment in concert with OGD agencies, in particular the Communications Security Establishment Canada (CSEC) and Canadian Security Intelligence Service (CSIS),

5. (S/

Evaluation/Analysis

6. (S,

REPORT - 3/21 SECRET

A0383244 10-A-2012-01720 - 10

RELEASED UNDER THE AM - UNCLASSIRED INFORMATION DIVULGU EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET)

7. (S

a.

b.

Determinations

8. (S,

Action Implementation 9. (S/ the RCN undertook a pan-i\avy investigation to ensure that existing BCPs were updated and verified that existing Unit Security Orders were current and drafted IAW existing security policies. Once verified, refresher training for all pers in MARPAC and MARLANT was initiated. 10. (S,

a.

REPORT - 4/21 SECRET

A0383244 11-A-2012-01720 -11

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET

Lessons Learned

11. (S;

12. (S,

Business Continuity Planning (BCP) 13. (S. BCP within the Government of Canada generally falls under the responsibility of the DSO and is reported on in the Management Accountability Framework (MAF) as such. BCP within DND is the responsibility of commanders at all levels and is overseen at the national level by the SJS. BCP is neither normally tied into the Business Planning Process, nor is it routinely exercised or assessed. After the discovery of Delisle's activities, was conducted partly IAW the applicable BCP and partly as an ad hoc reaction to the requirement. The security transformation Management Action Plan (MAP) will include options to incorporate BCP (perhaps renamed operational resilience planning for CF purposes) into the proposed centralized security authority. This would allow a seamless process to occur when a security inspection or audit discovers security issues that are serious enough to suspend the clearance of a system, facility or unit, so that the BCP must be activated and this process can also be assessed and reported upon in a comprehensive fashion. FORCE PROTECTION General 14. (S On reviewing the circumstance surrounding the Delisle case, Canada COM determined there was need to re-evaluate the CF force protection posture within the domestic AOR. The HQ staff conducted a brief appreciation in conjunction with the SIMAT. The assessment determined that, while a general increase in force protection posture was not required, there was a need to increase situational awareness with respect to security threats within the AOR and/or implement select information security force protection measures. Rather, a force protection tasking order was drafted, in consultation with SIMAT, to achieve these aims. The order was issued by Canada COM at COMD 002/12 DTG 081952Z MAR 12. REPORT - 5/21 SECRET
A0383244 12-A-2012-01720 -12

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUg EN VERTU DE LA LAI - RENSH6NEMENTS NON CLASSIFY

8.15(1)

SECRET

15. (G The Canada COM force protection tasking order instructed CF elements within the domestic AOR to implement the following force protection measures (FPM):

a.
b. c. d.
16. (G All addressees to the order acknowledged receipt and undertook implementation. Canada COM HQ continues to respond to questions from outstations and is providing ongoing coordination and guidance. Canada COM HQ will continue monitor the implementation of additional FPM. Reaction within the Government of Canada 17. (S, When Delisle's activities were discovered, the criminal investigation was undertaken by the RCMP, with associated security intelligence activities undertaken by CSIS. Eventually, charges were laid and are now being pursued in civilian court. Little or no discussion concerning the advantages of employing the Military Police to lead the criminal investigation, the CFNCIU to lead the counter-intelligence investigation and laying the charges under the Military Justice System (MJS) appears to have occurred and/or fully informed decisions made WRTthe way ahead. An incident such as this should be viewed as primarily a security issue and the decision to arrest, lay charges or otherwise indicate to the FolS (Foreign Intelligence Services) involved that Canadian authorities are aware of the individual and his activities should be undertaken in a fully-coordinated and well-informed manner. Whenever a member of the CF is suspected of involvement in such activities, the default practice should be to inform DND immediately and an early decision made at the appropriate level within the Government of Canada as to how the matter should be approached. There may be cases where non-DND entities should assume the lead, but the advantages of using intrinsic assets to investigate and possibly exploit individuals involved, as well as pursuing any charges in the MJS dictate that this should be the norm, with RCMP and CSIS assistance utilized on an "as required" basis. All senior Government authorities involved in security and intelligence matters should be made aware of the alternatives available to pursue suspects subject to the Code of Service discipline, so that automatic defaults to mechanisms more applicable to civilians do not occur. The security transformation MAP will envision a sufficiently resourced DND DSO, organizationally situated at a sufficiently high level and with responsibility for effective liaison with PCO, CSIS etc. This should ensure appropriate awareness and informed decision making before any process is embarked upon, as well as the capacity to coordinate effective responses to such incidents in the future. Security and Counter-intelligence Investigations 18. (S, DND has a counter-intelligence capability in the CFNCIU, Low-level or initial security investigations are normally conducted by the local Military Police, augmented by Summary Investigations or BOIs, where required by policy. REPORT - 6/21 SECRET,
A0383244 13-A-2012-01720 - 13

RELEASED UNDERTOEHA - UNCLASSIFIED INFORMATION DIVULGUS EN VERTU DE LA LAI - RENSHGNRMBMTS NOW CLASSIC

SECRET

Good security practices harden facilities, systems and organizations against attack and compromise, and when used in an interlocking fashion with other measures, greatly reduce the possibility of successful espionage.

The security transformation MAP will incorporate an audit and inspection regime, as well as a reinvigorated training, education and awareness programme that will improve security practices across DND. 20. (Si The Delisle case reveals several deficiencies in the extant Defence Security Programme. Many of these have also been identified in CRS and OAG audits, as well as through the MAP. A proposal by the Departmental Security Officer (DSO) has been agreed to, in principle, by VCDS and subsequently briefed to DSX. This proposal plans to address these deficiencies, starting with approval to create a comprehensive MAP and work plan that will include detailed analysis, a proposed CONOPS and draft MIP for presentation at Defence Management Committee (DMC) as soon as practicable, designed to consolidate the many disparate security processes and functions in one appropriately positioned and resourced security authority. Summary 21. (S The Departmental Security Programme is and in need of transformation. DND is one of the most targeted departments within the Government of Canada. Whether the threats are technological, human or physical, vulnerabilities must be assessed within a comprehensive, integrated and efficient approach to enterprise security risk management. The security transformation MAP and associated mechanisms is a logical process to address the security related concerns and allow for informed decision making WRT risk acceptance. It should be approved, finalised and implemented as soon as possible. INTELLIGENCE 22. (U) Details have been promulgated at Annex G (released under SEPCOR). REPORT - 7/21 SECRET,
A0383244 14-A-2012-01720 -14

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION 3IVULGUE EN VERTU DE LA LAI - RENSBGNEMENTS NON CLASSIFIES

SECRET)

s.15(1)

INFORMATION MANAGEMENT Synopsis

28. (U) Annexes B and C provide details of actions, outcomes and issues relevant to the Cyber Defence Incident Response Process for this operation. Evaluation/Analysis

REPORT - 8/21 SECRET/

A0383244_15-A-2012-01720 - 15

RELEASED UNDER THE A - UNCLASSIRED INFORMATION DIVULGUE' EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET,

S'15(1)

Determinations 30. (S, Following the IMCAT held 20 Jan 12, it was determined that the incident triggered CCIR 2 (Challenges to Sovereignty) and CCIR 6 (events involving DND/CF with potential to generate significant public or international interest). Action Implementation 31. (S Following the Sub-Lieutenant Delisle incident, the need to have an overall security management and event capability became apparent. Implementation of the Security Information and Event Management (SIEM) system was already ongoing, which would provide that type of capability; however, since the initial intention was to implement SIEM following a low-high approach, priority of work was re-aligned and CLAS domain became the priority versus DES, even though all activities are being undertaken in parallel mode in order not to lose momentum. Latest classified activity is under RFC 72349. Lessons Learned 32. (Cl The following findings are derived from the CFNOC Cyber Defence Operations review of activities and outcomes during Op DIAMOND. These findings have been documented in an effort to provide lessons observed and generate further discussion to develop action items in an effort to enhance response time and increase cyber defence competencies when responding to future high-level incidents of this nature. 33. (S/ a. Findings. Identified CFNOC internal gaps/recommendations include: an accurate list of all Network Operational Authority staff who need to be contacted when a decision is required needs to be established and maintained for operational effectiveness and accountability; a complete breakdown of external agencies respondent to CFNOC would facilitate the tasking process (i.e. DIMEI, DIMCA, DIMTPS, 76 Comm Gp); external tasking instructions should be as detailed as possible to ensure various System Administrators maintaining network logs for their specific network enclaves provide concise returns (DTG, Location, and Systems) and to avoid confusion; CFNOC has an enterprise mandate to protect all DND/CF networks and would benefit from acquiring all pertinent network topology and schematics to enhance SA and Cyber/Network Defence posture; and the current relevant information to maintain SA externally and internally to CFNOC on current Cyber Defence Operations, as required, during high level operations. Findings. Identified external gaps/recommendations include: a. a lack of response to CFNOC requests for feedback to be included in the AAR from external stakeholder units;

b. c.

d.

e.

34. (S;

REPORT - 9/21 SECRET,

A0383244 16-A-2012-01720 -16

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIE

5.1-5(1)

SECRET,

b.

external agencies require a general understanding of the current cyber defence mission to ensure compliance and SA is maintained: (1) the establishment of daily or weekly Battle Update Briefs (BUB) with stakeholders is recommended to ensure fluid passage of information, understanding of priorities and compliance; and identification of critical cyber defence stakeholders regarding

(2) c.

d.

development of operational orders that delineate key factors in ensuring mission requirements to be met, to include: (1) (2) (3) a comprehensive communications plan establishing contact points, types of deliverables and higher level directives for adherence by all stakeholders; OPSEC guidelines to capture the Commander's intent and regulations governing the handling of the mission; and detailed groupings and tasking to avoid duplication of effort and to ensure stakeholders complete their assigned mission segments in accordance with commanders' requirements; and implementation of an emergency RFC approval process for the deployment of cyber defence tools on any network segment, to ensure timely response on any DND/CF enclave.

e. f.

35. (U) The intent is that this AAR form part of follow-on discussions and processes to close identified gaps, with a focus on upgrading and reinforcing the cyber defence capabilities on all CF networks, in support of CF missions. While the aforementioned provides recent status update, additional information may follow as required. DEPARTMENTAL SECURITY

REPORT-10/21 SECRET
A0383244 17-A-2012-01720 -17

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUg EN VERTU DE LA LAI - RENSETCMEM :r-TS H'ON CLASSIFIES

SECRET

s.23

INVESTIGATION 36. (U) Details provided at Annex G (released under SEPCOR). LEGAL PROCEEDINGS Synopsis 37. (U) Following investigation by the RCMP and CSIS, Sub-Lieutenant Delisle was taken into custody by the RCMP on 14 January 2012. He was charged with one count of Breach of Trust, pursuant to s.122 of the Criminal Code of Canada and two counts of Communicating Safeguarded Information to a Foreign Entity without Lawful Authority, pursuant to s.16(1) of the Security of Information Act. The former charge carries a maximum sentence of five years imprisonment, whereas the latter charge carries a maximum sentence of imprisonment for life. 38. (U) Sub-Lieutenant Delisle appeared initially before the Provincial Court of Nova Scotia on 17 January 2012 in order to determine bail, where his counsel at the time requested a delay in order to have more time to prepare. Following several more delays, Sub-Lieutenant Delisle was eventually denied his application for bail on 30 March 2012, and a publication ban on evidence presented as part of this application was granted. 39. (U) On 8 May 2012, Sub-Lieutenant Delisle's counsel again appeared before the Provincial Court of Nova Scotia and requested an adjournment. This request was made in order to permit the Crown more time to review and release relevant documents. The request was granted, and the case was adjourned until 13 June 2012. Subsequent determinations have since resulted in additional adjournment and Sub-Lieutenant Delisle's election to be tried by a Nova Scotia Supreme Court judge and jury. An administrative court appearance was expected on 21 September, but did not occur. Accordingly, a three-day hearing, to commence on 10 October remains scheduled.

40. (C/

Solicitor-Client Privilege -

41. (C/

Solicitor-Client Privilege

REPORT- 11/21 SECRET

A0383244 18-A-2012-01720 -18

RELEASED UNDER THE AIA - UNCLASSIRED INFORMATION DIVULGUS EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIRE5

= 'Jl >f

SECRET;
Current Situation 42. (C/ Solicitor-Client Privilege -

5.21 (i>(a)
s.23

43. (C/

Solicitor-Client Privilege -

POLICY Parliamentary Queries 44. (U) There has been minimal Parliamentary activity with regard to the Delisle case. Indeed, there has been just one question asked in the House on the matter. On 10 Feb 2012, NDP MP Don Davies asked about apparent contradictions between media reports he said were fed by "Conservative sources" that four Russian diplomats were expelled over the Delisle case and Russian denials that this was indeed the case. He asked whether the story was meant to distract attention from "this massive security failure," which he also referred to as the "biggest intelligence breach in recent Canadian history." Deepak Obhrai, Parliamentary Secretary for to the Minister of Foreign Affairs, refused to comment on the grounds that the matter related to national security. 45. (C From 22-28 August, the generation of Advice to the Minister, subject "Misconduct," was coordinated by D Parl A amongst VCDS, SJS, CMP, ADM(PA) and SIMAT staffs. This document included reference to charges against Sub-Lieutenant Delisle. Specifically, advice stated that should the Minister be asked about the Delisle case, he should respond that that the CF take the security of sensitive information very seriously; that CF personnel handling sensitive information observe stringent procedures and are held to a high ethical standard; that Sub-Lieutenant Delisle has been charged with offenses under the Criminal Code and the Security of Information Act following a comprehensive investigation by the RCMP, assisted by the CF; and that he cannot comment further, since the investigation is ongoing and the matter is before the courts. Media background included with this document included an update on items pertaining to the Delisle case. Relations with the Russian Federation

46. (S/

REPORT- 12/21 SECRET/

A0383244 19-A-2012-01720 - 19

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET'

48. (C,

In the meantime,

In September 2011, the Chief of Defence Staff and National Security Advisor visited their Russian counterparts in Moscow. This was followed by a November 2011 Russian delegation visit to NDHQ, where discussions between the Chief, Military Personnel and Russian counterparts took place on a range of issues, including recruitment, training and education, and compensation and benefits. Another Russian delegation visited Canada Command in February 2012 to acquire Canadian Forces lessons learned from security operations undertaken in support of the 2010 Vancouver Olympic (Operation PODIUM), as well as the G-8/G-20 Summits (Operation CADENCE). 49. (C, Russia participated in the Northern Chiefs of Defence meeting hosted by CDS in Goose Bay NL, 12-13 April. The meeting was intended to build upon existing defence relationships in the region and to strengthen operational links, as identified in the CDS/DM Directive on the North. The meeting also supported Canada's Arctic Foreign Policy, which seeks to advance the Government's Northern Strategy by enhancing bilateral and multilateral cooperation with other Arctic countries. General Makarov, Chief of the Russian General Staff, attended, along with a delegation of six high ranking military representatives. 50. (U) The most recent high-level DND/CF interaction with Russia was the attendance of the thenDeputy Commander of the Royal Canadian Air Force at an Open Skies conference and air show in Moscow in August 2012. The event, attended by over 75 countries, was to mark the hundred-year anniversary of the Russian air force. The conference was to discuss military-technical cooperation, training of air personnel, organization and use of airspace, and flight safety, among other topics.

PUBLIC AFFAIRS/COMMUNICATIONS Public Affairs Concept of Operations 52. (U) An initial Public Affairs (PA) Concept of operations (CONOP) has been implemented to coordinate responses to media queries, and the release of information to the public related to the Delisle case. REPORT-13/21 SECRET
A0383244 20-A-2012-01720 - 20

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION D1VULGUE EN VERTU DE LA LAI-RENSHGNEMENTS NON CLASSIFIES

s.15(1) SECRET

Public Affairs Approach

53. (S The initial and current PA approach for the release of information regarding this issue is PASSIVE. Public Affairs Coordination 54. (C Given the serious nature of the charges and the perceived implications for national security and diplomatic relations, the need for careful, close coordination has been recognized in ensuring that messaging is in alignment with a central Government of Canada narrative. However, responses to media queries have been coordinated on a case-by-case basis.
Media Synopsis

55. (U) Initial media interest on this file has been extensive and international in scope. Coverage has since been intermittent, and directly tied to the frequency of court appearances. A publication ban has been put into effect limiting domestic coverage, but leaving the door open for international reporters in attendance at court appearances.
56. (C. Queries:

a. b. c. d.

28 queries were responded to between 16 and 25 January - prior to the stand-up of SIMAT and adoption of the PA CONOP; seven media queries were responded to between 26 January and 30 April; five media queries were responded to between 1 May and 1 September; and delays of up to four days were encountered when processing query responses.

57. (C Reporters: Teams of reporters have been assigned to this case (summarized below) and have conducted research/interviews which may appear in future articles coinciding with court milestones. 58. (U) Broadcasts:

a.
b.
c.

CBC RDI CTV-

d.
59. (U) Print: a. b.

GLOBAL-:

HALIFAX CHRONICLE HERALD TORONTO STAR -

c.

NATIONAL POST -

REPORT-14/21

SECRET

A0383244 21-A-2012-01720-21

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DMJLGU EN VERTU DE LA LV - WfcHGNEMENTS NON CLASSIFY

SECRET

S'19(1)

s.23

d.

MACLEANS -

60. (U) Wire Service: a. b. CANADIAN PRESS POST MEDIA v

61. (U) International: a. b. C. d. 6. PERSONNEL Welfare of and Support to Sub-Lieutenant Delisle 62. (C Evaluation. To date, there has been no direct contact support to SubLieutenant Delisle; however, he is aware that Lieutenant (Navy) Dobson is the Assisting Officer. This current arrangement will likely change upon administrative review, which is currently on hold, pending further trial developments. With respect to administration, the Assisting Officer conveys information through Sub-Lieutenant Delisle's lawyer, Mr Mike Taylor. There has been one administrative matter regarding pay for which TRINITY coordinated information from SubLieutenant Delisle regarding new banking information, NEW YORK TIMESWALL STREET JOURNAL TELEGRAPH THE AUSTRALIAN AUSTRALIAN ASSOCIATED PRESS -

63. (Si Determinations. TRINITY has determined that until it becomes absolutely necessary, all communications with Sub-Lieutenant Delisle are to be conveyed through his lawyer. 64. (C, Action Implementation. There has been no direct contact. All administrative support provided by TRINITY has been through Sub-Lieutenant Delisle's lawyer,

65. (C. Lessons Learned. Handling of all associated administrative paperwork should be effected through the Member's lawyer, in order to maintain full impartiality. Synopsis of Personnel Support to Sub-Lieutenant Delisle's Dependants 66. (C Sub-Lieutenant Delisle was taken into custody by the RCMP on 14 Jan 12. HMCS TRINITY CoC immediately undertook actions to contact the family members REPORT-15/21 SECRET,
A0383244 22-A-2012-01720 - 22

RELEASED UNDER THE AIA - UNOASSIRED INFORMATION DIVULGUfENVERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET)

and offer assistance.

Status of Dependants

REPORT-16/21 SECRET
A0383244 23-A-2012-01720 - 23

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGU^ EN VERTU DE LA LAI - RENSOGNEMENTS NON CLASSIFIES

SECRET

S.19(1)

74. (U) Determinations. It is highly important to establish support, utilizing all available resources, as early as practical and maintain open lines of communications. 75. (U) Action Implementation. From the moment contact was established with family members, HMCS TRINITY'S Executive Officer and Assisting Officer have assisted all concerning as best as possible, seeking and relaying information, by telephone and email with relatives. 76. (C Lessons Learned. A flexible, adaptive approach to established SOPs in establishing contact, assisting and facilitating contact between the family and key agencies POCs enabled TRINITY to effectively satisfy the family's concerns in an expedient and professional manner.

REPORT-17/21 SECRET,
A0383244 24-A-2012-01720 - 24

RELEASED UNDER THE AIA - UNCLASSIRED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSBGNEMENTS NON CLASSIFY

SECRET

S.19(1)

80. (C// Lessons Learned. Acknowledge requests, but prior to responding always ensure verification of the matter with appropriate Orderly Room staff and/or other SME and AJAG, prior to furnishing a response. In all cases, when knowledge regarding a specific query resides at the Formation Orderly Room, a designated SME should directly provide the response to

81. (C, Since Sub-Lieutenant Delisle was arrested by the RCMP in January, TRINITY has provided extensive support to his family (in particular, TRINITY'S Executive Officer has informed Sub-Lieutenant Delisle's In all instances, TRINITY ensured SME at the Formation Orderly Room and AJAG were consulted prior to providing responses to requests. In anticipation of the upcoming trial, TRINITY intends to retain Lieutenant (Navy) Dobson as Attending/Assisting Officer, pending a change in administrative requirements.

REPORT-18/21 SECRET
A0383244 25-A-2012-01720 - 25

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DMILGUE EN VERTU DE LA LAI - RENSEIGNEMENTS NON OASSIFI'

SECRET/,

REPORT-19/21 SECRET;
A0383244_26-A-2012-01720 - 26

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATION DWULGUE EN VERTU DE LA LAI - RENSBGNEMENTS NON CLASSIFIES

SECRET;

s'15(1)

SECTION THREE - CONCLUDING MATERIAL SIMAT CO-CHAIR DEDUCTIONS AND DETERMINATIONS 1. (S/, Assessments pertaining to specific issues are contained within respective sections, as submitted by the corresponding Offices of Primary Interest, with additional SIMAT comment provided where warranted. Otherwise, from an orientation and procedural perspective, activity undertaken by SIMAT representatives, which includes departmental security SMEs, has aptly illustrated that, while the circumstances pertaining to the Delisle case are unique unto themselves, the following overarching deductions and determinations are nevertheless highly relevant:

a.

b.

c.

d.

e.

f.

h.

REPORT - 20/21 SECRET;

A0383244 27-A-2012-01720 - 27

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET,

ANNEXES: Annex A (SECRET//LIMDIS) Director of Staff Initiating Directive Security Issue Management Action Team (Delisle Case) (SECRET, CFNOC Operation Diamond Final SITREP 162200Z - 212200Z FEB 2012 (less appendices) (SECRET. Operation Diamond (less annexes) CFIOG After-Action Report

Annex BAnnex CAnnex DAnnex E Annex FAnnex G -

(UNCLAS) Advice for the Minister - Misconduct (UNCLAS) ADM(PA) Media Monitoring and Analysis - Security Summaries (SECRET, Action Plan (Abbreviated) DSO Security Transformation Management

(SECRET List of Primary Referenced Documents (Released Under Separate Correspondence)

REPORT-21/21 SECRET
A0383244 28-A-2012-01720 - 28

RELEASED UNDER THE AIA - UNOASSIRED INFORMATION

Anpex A ,

2100-1 (SIM AT) SIMAT REPORT 28Sep12 SECRET fLIMDISI

. H

National Defence
Siratejic Join: Sta" Dirscto-of Staff Nationa; Defence Headquarters OttavrB. Ontario K1AC-K2

Defense nationals
Etat^majc' interarrr.ees stratftjique Direaeurdereiat-fnaior Quarter genera: ae la Defense natona'e Ottawa. (Ontario) K1AOK , j

2100-1 (SJSDACV) January 2012 Distribution List DIRECTOR OF STAFF INITIATING DIRECTIVE SECURITY ISSUE MANAGEMENT ACTION TEAM (DELISLE CASE> References: A. National Defence Security Policy, 4 January 2012 B. CDS Weekly Operations Briefing, 24 January 2012 GENERAL 1. Further to Reference B, circumstances concerning recent security-related allegations against Sub-Lieutenant J.P. Delisle have necessitated the establishment of a standing staff mechanism through which to provide ongoing coordination, management and adjudication of the Department's oversight of associated issues. Accordingly, I plan to establish a Security Issue Management Action Team (SIMAT).
AIM

2. SIMAT will serve as the principal conduit for the provision of srtuational awareness from all sources and response coordination. It will also recommend direction and guidance to senior leadership on a regular recurring basis, in order to assure effective strategic oversight and harmonization of effort pertaining to these issues. SCOPE 3. SIMAT will address any and all matters pertaining to departmental security issue management attributable to or resulting from the associated security breach, following a general process of issue identification, management analysis, evaluation, action implementation/coordination and monitoring/review. It will achieve this in the following manner: a. capture all relevant issues, as identified by representatives or otherwise submitted; b. provide characterization, analysis and assessment, along with determination of priority, OPI/OCL actions taken and current status; c. track and review ongoing issues and provide updated recommendations to departmental senior leadership through DOS SJS;

1/3 A-1/5 V^dUdXla

SECRET (LIMDIS)
A0383244 29-A-2012-01720 -29
SECRET

(LIMDIS)

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATION

SECRET (LIMDIS)

OIVULGUE EN VERTU DE LA LAI - RENSBGNEMENT5 NON CLASSIFIES

5.15(1)

SECRET (LIMDIS) d. receive departmental senior leadership direction through DOS SJS and promulgate accordingly; and e. maintain records of all proceedings and staff actions for archival purposes. 4. Representatives denoted in Annex A constitute the composition of SI MAT, which has been determined on the basis of immediate requirements and will be subject to further modification, as circumstances dictate. In order to fulfil SIMAT requirements, representatives are Lieutenant-Colonel/Commander/civilian equivalent or higher, possessing no less than a SECRET-level clearance. Note that, while existing departmental links with external agencies will be maintained. SIMAT-specific contacts will be effected through DOS SJS. 5. SIMAT will be chaired by Colonel Dave Higgins of my staff and meet at least weekly, preceded and followed by direct reporting to DOS SJS, thereby completing the departmental issue management cycle. 6. The initial SIMAT, to be held in the JSAT (Room 201) from 1300 to 1400 hours on 30 January 2012, will provide representatives with overarching guidance, outline procedural parameters, specify deliverables and establish the requisite battle rhythm. Recurring weekly meetings will take place in the JSAT on Tuesdays from 1300 to 1430 hours. PRIORITIES 7. SIMAT priorities will be established on a descending order of departmental criticality, essentiality anoVor desirability, based upon the recommendations of representatives and/or strategic direction provided. CONCLUDING REMARKS 8. Departmental exigencies are evident and I seek your support in according due priority to this highly important undertaking. Clearly, success will be contingent upon the thoroughness, efficacy and flexibility of all concerned in fulfilling individual and collective responsibilities through-SIMAT. 9. Please direct any queries directly to Colonel Higgins, SJS DACV, at (CSNI). or 613-995-2511 (office), 613-286-4754 (mobile), david.hio.ginsforces.gc.ca, (DWAN).

/
/

Major-General Annexes; Annex A DSIMAT Composition Annex B - DSIMAT Management Coordination Matrix Distribution List (Page 2)
2/3

A-2/5

SECRET flJMDIS)

SECRET (L.MD.S) A0383244 30-A-2012-01720 - 30

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION

SECRET (LIMDIS)

DMJLGU EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET HJMD1S) Distribution List Action Chair DSIMAT (SJS DACV) SJS DGO/DCO MNDO VCDS Comd Canada COM Comd CEFCOM Comd CANSOFCOM Comd CANOSCOM C Naval GDI CMP JAG ADM(PA) ADM(Pol) Information

CDS DM C Army C Air Force DCINC NORAD CANMILREP NATO MILAD PRMNY Comd CDLS(W) Comd CDLS(L)

3/3
A-3/5

SECRET (LIMD1S)

SECRET fLIMDIS) A0383244 31-A-2012-01720 - 31

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATION

SECRET (LIMDIS)

DMJLGUE EN VERTU DE U LAI - RENSHGNEMENTS NON CLASSIFIES

SECRET fLIMDiSI Annex A To 2100-1 (SJS DACV) DOS Initiating Directive - SIMAT (Delisle Case) 2f" January 2012 DSIMAT Composition

Organization

:r

SIMAT Chair (SJS) VCDS/DSO { VCDS/CFPM j VCDS/CFNIS C NAVAL

GDI CMP JAG

ADM(PoI) ADM(PA) SJSDGO Canada COM CEFCOM CANSOFCOM CANOSCOM MNDO

' ' Representative Col Higgins (Chair) Col Lander (DSO) LCol Trudeau (DPM RM) LCol Delaney (CO CFNIS) Capt(N) Plows (COS RCN) ** BGen Williams (DGMS) LCol Thompson (J1 Coord) LCol Bolt (DLAW I&IO) A. Anishchenko (D Strat A) LColTheriault(SJSPA) Col Williams (A/DGO) " LCol Mills (A/COS) Capt(N) Eldridge (COS) Cdr Cope (SMA) ** Capt(N) Hudock after 10 Feb

:"{ Alternate .: . LCol Rouleau

LCol Humphrey Capt Utton Maj Cadman
TBC

Maj Pouliot Maj Dow S. Sixsm'rth LCol Gaudet LCol Demers

TBC TBC

Maj Lavigne
.

A-1/1 A-4/5 SECRET HJMDIS) .iMuisy SECRETTC

A0383244 32-A-2012-01720 - 32

DIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON OASSIFIE

SECRET fLIMDIS) WHEN COMPLETED)

Annex B To 2100-1 (SJS DACV) DOS Initialing Directive - SIMAT (Delisle Case) 7.7- January 2012

SIMAT MANAGEMENT COORDINATION MATRIX

ShotDiitrpttcn

,.;'.

Colow I

Whattu.rtk.oipM>r^Wliuudi>U^4u>fil>IMM

.v;,:^,i/.: .v:';.:\;V''V-';A''':: [.i'x^-l j'^i'':^;^^^'-:^^^-^;^*'/.!'''^.^N

GO

CC

LU

B-1/1

SECRET (LIMDIS) (WHEN COMPLETED^ A0383244_33-A-2012-01^0 - 33

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSHCMETI^nT. NON CLASSIFII

Annex B SECRET 2100-1 (SIMAT) SIMAT REPORT 28Sep12

CFNOC OP DIAMOND FINAL SITREP - 162200Z - 212200Z FEE 2012 Commander's Assessment 1. CFNOC has completed the final stages of the Find and Understand phases of the Cyber Incident Response Process. We have not found evidence of a network compromise related to the activities of SLt Delisle and Network Operations have returned to NORMAL.
2.

3. Supporting and Supported Units that have items of note that they wish to have included in the Op DIAMOND After Action Report (AAR) are asked to forward these to CFNOC for inclusion. 4. CFNOC remains on standby to expand its OP DIAMOND effort pending further instructions from the SJS Security Management Incident Action Team (SMIAT).

5.

Background 6. Following the arrest of SLT Delisle, locations in Halifax required inspection to ensure the confidentiality, integrity and availability of the work spaces and DND/CF IS infrastructure. 7. CFNOC was directed to coordinate technical activities on behalf of ADM(IM) necessary to return Trinity and to full operational status as a result of the IMCATheld20Jan 12 8. This incident triggered the following CCIRs:

a.

SECRET

1/3 B-1/3
A0383244 34-A-2012-01720 - 34

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGU EN VERTU DE LA LAI - RENSBGN'-M :N1S HON OASSIFIE.'

SECRET; b. CCIR 6 - "Events involving DND/CF with potential to generate significant public or international interest (may be minor events with disproportionate impact)" 9. Media interest based on CF member exfiltrating classified information from CF/DND networks; and Media interest of TSCM activities reported in Globe and Mail articles 2528 Jan.

CFNOC focused its efforts on the following two (2) lines of operations:

a.

10. The following major tasks were completed a. Deployed teams from CFNOC TSCM and 76 Comm Gp to Halifax;

b.
c. Obtained various system OAs approvals to employ tools and equipment in support of CFNOC's scan and data collection;

d. e.
f.

g-

Completed Tasks (Since last SITREP)

n.

SECRET
2/3
B-2/3
A0383244 35-A-2012-01720 - 35

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DWULGUE EN VERTU DE LA LAI - RENSHGNEMB T.-. K DM CLASSIFIES

12.

SECRET CFNOC AAT has completed all analysis of computer drives, images, logs and relevant information. There was no evidence cyber exploit or malware detected based on current analysis capabilities. A detailed plan of AAT specific malware, cross-validation, and extraordinary incident tests for Op DIAMOND is provided at Appendix A of this SITREP; CFNOC Surveillance team completed the analysis of the following network activity logs for indications of malicious activity. a. SLtDelisle's been analyzed account has - Result: NSTR; and

13.

b.

Ongoing Tasks

14.

15.

16. CFNOC has begun development of an After Action Report to collect lessons observed from this incident and to offer recommendations on the way ahead to better defend DND/CF networks, with emphasis on insider threat. Upcoming Tasks

17.
18. CFNOC is on standby for possible request from SJS SMIAT instructions for scans at sites outside of MARLANT in response to SLt Delisle's past activities. Areas of concerns 19. CFNOC analysis in support of cyber defence for the impacted networks has been slowed by requirement for third parties to prepare and hand over logs to CFNOC versus having direct access.

SECRET
3/3 B-3/3
A0383244 36-A-2012-01720 - 36

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DMILGUE EN VERTU DE LA LAI - RENSEKNEMEN'-'S N' .14 3.ASSIFIES

Annex C SECRET/ 2100-1 (SIMAT) SIMAT REPORT 28Sep 12

2788 (CD Ops O) 14 May U Distribution List AFTER-ACTION REPORT (AAR) OPERATION DIAMOND 1. (S) This AAR presents the timeline of actions, activities, successes, and identified gaps encountered by various agencies involved in OP DIAMOND. During OP DIAMOND one of CFNOC's implied tasks was to successfully detect and mitigate potential network threat posed by foreign actors. This operation was in response to perceived insider threat following the arrest of Sub-Lieutenant (SLt) Jeffery Delisle on 14 Jan 12 on charges of breaching the Security of Information Act (a portion of the Canadian Anti-Terrorism Act) of 2001. 2. (S) Following the arrest of SLt Delisle,

3.

4. (U) Annex A provides the detailed timeline of actions, outcomes and issues the relevant to the Cyber Defence Incident Response Process for this operation. 5. (U) Overall, CFNOC considers OP DIAMOND to be an unmitigated success for the managed incident response process as practiced by the CFNOC Cyber Defence Operations team. The operation served has to highlight the highly professional conduct of all Units supporting this coordinated effort. Due to the successes that were seen during the conduct of OP DIAMOND, the gaps identified in this AAR will serve to fine tune the already satisfactory processes and actions, not act as the catalyst for wholesale changes. 6. (U) Below are the findings based on CFNOC Cyber Defence Operations review of activities and outcomes during OP DIAMOND. These findings have been documented in an effort to provide lessons observed and generate further discussion to develop action items in an effort to enhance response time and increase cyber defence competencies when responding to future high-level incidents of this nature. 7. (S) Internal Gaps. Identified CFNOC internal gaps include: a. An accurate list of all Network Operational Authority staff who need to be contacted when a decision is required needs to be established and maintained for operational effectiveness and accountability;

C-l/3 SECRET
A0383244 37-A-2012-01720 - 37

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGU EN VERTU DE LA LAI - RENSHGNEMFNT.i ."<X\S

SECRET.

b. A complete breakdown of external agencies respondent to CFNOC would facilitate the tasking process (i.e. DIMEI, DIMCA, DIMTPS, 76 Comm Gp); c. External tasking instructions should be as detailed as possible to ensure various System Administrators providing network logs for their specific network enclaves provide concise returns (DTG, Location, and Systems) and to avoid confusion; d. CFNOC has an enterprise mandate to protect all DND/CF networks and would benefit from acquiring all pertinent network topology and schematics to enhance SA and Cyber/Network Defence posture; and e. The current relevant information to maintain SA externally and internally to CFNOC on current Cyber Defence Operations as required during high level operations. 8. (S) Find in es. - Identified external gaps include: a. Lack of response to CFNOC's requests for feedback to be included in the AAR from external stakeholder Units; b. External agencies require a general understanding of the current cyber defence mission to ensure compliance and SA is maintained: (1) the establishment of daily or weekly Battle Update Briefs (BUB) with stakeholders is recommended to ensure fluid passage of information, understanding of priorities, and compliance; and identification of critical cyber defence stakeholders regarding

(2) c.

d. The development of operational orders that delineate the key factors in ensuring mission requirements are met: (1) (2) (3) a comprehensive communications plan establishing contact points, types of deliverables and higher level directives for adherence by all stakeholders; OPSEC guidelines to capture the Commander's intent and regulations governing the handling of the mission; and detailed groupings and taskings to avoid duplication of efforts and to ensure stakeholders complete their assigned mission segments in accordance with the Commanders requirements;

e. f. Implementation of an emergency RFC approval process for the deployment of cyber defence tools on any network segment to ensure timely response on any DND/CF enclave.

C-2/3

SECRET//
A0383244 38-A-2012-01720 -38

RELEASED UNDER THE AIA - UNCLASSRED INFORMATION DIVULGUg EN VERTU DE LA LAI - RENSHGilEM^TJ TON CLASSIFlfe

SECRET/,

9. (U) The intent is that this AAR form part of follow-on discussions and processes to close identified gaps, with a focus on upgrading and reinforcing the cyber defence capabilities on all CF networks, in support of CF missions. 10. (U) Of note, the support provided to CFNOC during OP DIAMOND by the following CF/DND personnel was outstanding: a. MARLANTISSO (Mr. Bill McFadden) and staff; b. TSAANS (Mr. Scott Costello and MCpl Keith Richards); c. the following Operational Authorities or representatives for DWAN (Mr. Len Bastien), CSNI (LCol Dave Yarker), and d. 76 Communications Group Ops (Capt Derek McDowell and WO Marc Gervais);

e.
f.

; and
SABNS 3 (Mr. Mark Eisenstat, Mr. Ty Lo, and Mr. Jeff Pilgrim).

11. (U) Questions can be directed to Captain Scott Durno, CFNOC Cyber Defence Operations Officer at 945-7414.

Alex Tupper LCol CO CFNOC 945-7400 Annexes: Annex A - Detailed Timeline Dist List Action CF J6 Coord SJS Support Ops Info IMCAT Secretary EMCAT Membership
C-3/3

SECRET.
A0383244 39-A-2012-01720 - 39

SED UNDER THE AIA - UNCLASSIFIED INFORMATION IVULGUE EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES Annex D 2100-1 (SIMAT) SIMAT REPORT 28Sep 12

ADVICE FOR THE MINISTER

MISCONDUCT
ISSUE: We have heard of allegations of misconduct involving CF members, both as victims and perpetrators. What measures are being taken to protect CF members and reduce instances of misconduct? The Canadian Forces take all allegations of misconduct by personnel very seriously. The Canadian Forces also have a range of support services for members and families, and our highest priority is to the victims of any crimes. We hold our members to a very high standard of conduct and performance through a number of mechanisms, including the Code of Service Discipline, and where applicable, the Criminal Code of Canada. IF PRESSED ON ALLEGATIONS OF SEXUAL MISCONDUCT Canadian Forces members are subject to the Code of Service Discipline and are therefore held to the highest standards of professional conduct that is consistent with the values and expectations of all Canadians. Members of the Canadian Forces are required by regulations to bring breaches of the law by CF members or other military force partners to the attention of the appropriate authorities. All incidents of misconduct are to be reported, investigated and, where warranted, charges are laid. A CF member found involved in a case of sexual misconduct is liable to criminal, disciplinary and administrative action, including possible release from the CF. F PRESSED ON HARASSMENT AND ABUSE POLICY The Department of National Defence conducts mandatory harassment training for all civilians and military members, has created a series of complaint and support mechanisms for individuals who are victims of sexual harassment, and works hard to foster a work environment where such conduct is not tolerated. To that end, the Department of National Defence and the Canadian Forces are strongly committed to providing a workplace that is free of harassment and discrimination, and that promotes teamwork, mutual respect and fairness for all. Where issues do arise, Canadian Forces members have access to a number of channels to submit a complaint, including: Military Police; A Help Line for member assistance; The Chain of Command; The Canadian Forces Grievance Process; The Office of the Military Ombudsman.

-1/6

40

LEASED UNDER THE MA - UNCLASSIFIED INFORMATION /ULSJE EN VERTU DE LA UU - RENSEIGNEMENT5 NON CLASSIFY

IF PRESSED ON CHARGES AGAINST SLT JEFFREY DELISLE The Canadian Forces take the security of sensitive information very

seriously. All CF personnel handling sensitive information observe stringent procedures to protect its security and are held to a high ethical standard, consistent with the core military values of honour and loyalty. Following a comprehensive investigation by the RCMP, with assistance provided by the Canadian Forces, SLt Delisle has been charged with offences under the Criminal Code of Canada and the Security of
Information Act.

I cannot provide further details regarding the investigation conducted by the RCMP, as it is within the purview of the Commissioner of the RCMP to provide comment. This case is currently being considered in a Court of Law and SLt Delisle shall be afforded every opportunity to a fair and impartial trial without any conjecture from the MND.

"

D-2/6

AQ303244 4l-A-20'l2-0172l!) - 41

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATION MVULGUg EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFY

BACKGROUND: MISCONDUCT
ALLEGATIONS OF SEXUAL MISCONDUCT - If, after an investigation of a complaint, a member is determined to have ongagod in sexua misconduct, appropriate administrative steps will be considered depending on the circumstances. These measures can include, but are not limited to: o Initial counselling; o Recorded warning; o Counselling and probation; or o A recommendation of release. - In addition to the administrative measures outlined above, the Commanding Officer may consider a member's conduct to warrant disciplinary action and/or even relief from the performance of military duties. - If a member who is the target of the offensive behaviour is uncomfortable going to the chain of command, the CF have initiated a number of alternative systems to address the concerns of its members. These include the Canadian Forces Military Assistance Program (CFMAP) "1-800" number, the National Investigation Service, and the Ombudsman's Office. - All DND employees and CF members at all levels and ranks also receive training on the issues surrounding workplace harassment, how to avoid and address inappropriate behaviours, and what mechanisms are available to an individual for reporting harassment. MEDIA BACKGROUND: MISCONDUCT On 17 Jan 12, media reported on the 13 Jan 12 arrest of SLt Jeffrey Paul Delisle, as the first person to be charged under the Security of Information Act. In international news, Reuters quoted Minister MacKay saying "Let me assure you our allies have full confidence in Canada." On 18 Jan 12, media indicated that SLt Delisle was reportedly passing information to Russia, however DND did not confirm which entity received the material. On 19 Jan 12, media reported on a statement by the CDS maintaining that the CF takes the security of information very seriously and is always mindful of the effects of leaks. On 20 Jan 12, media reported that four staff of the Russian Embassy had been expelled in 'retaliation for Russia's alleged involvement in an espionage case.' Neither the PMO nor the Department of Foreign Affairs commented on the matter noting it was a matter of national security, and the matter was before the courts. On 09 Feb 12, media reported the Russian Ambassador to Canada as saying that Moscow has an agreement with the Canadian government to keep quiet about any connection between Russia and the case of SLt Delisle. On 28 Feb 12, media reported that SLt Delisle's bail hearing was set for 13 Apr 12. On 13 Mar 12, media reported on the announcement of an earlier date for the bail hearing of SLt Jeffrey Delisle. According to the media, the date of the bail hearing was moved forward following a request from his lawyer, Mr. Mike Taylor, and is now scheduled for 28 Mar. On 13 Mar 12, media reported on the delay of the trial of Pte Andrew Norman Wilson until Dec 12. Media reported that Pte Wilson, a combat engineer posted to CFB Edmonton, is charged with assaulting an American couple in Halifax in 2010. On 15 Mar 12, media reported that the case of SL1 Jeffrey Delisle, accused of sharing classified information with a foreign entity, has significantly damaged Canada's intelligence sharing relationships with key allies. According to the media, the extent of the leaks appear unknown and date back several years, even though SLt Delisle was allegedly only under surveillance for a few months. The media noted that although the Minister of National Defence, Peter MacKay, has stated that allies retain "full confidence in Canada," the case has raised questions about the security clearance process. On 21 Mar 12, media reported that assault charges against CFB Gagetown soldier Markus Alexander Scott have been dropped. On 24 Mar 12, media reported on the court martial of MCpl C.J.S. Agnew who was fined $500 for falling asleep while guarding the aircraft of the Prime Minister during a trip to Morocco in Jan 11. On 28 Mar 12, media reported that-the alleged leak of military intelligence to Russia by SLt Jeffrey Delisle may have created a significant rift between Canadian and American security officials. According to the media, a recent article in the Wall Street Journal also claimed that the volume linked to the breach was on the same level as the data loss the US experienced through WikiLeaks. Media noted that spokesperson for the Minister of National Defence Jay Paxton would not speculate on hearsay, but stated that, 'The minister has been clear that our allies remain fully confident of Canadian defence activities. That point was reiterated by the visit of MND MacKay's American and Mexican counterparts [Tuesday]."
D-3/6

42-A-29+2-01720^ 42

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DMJLGUS EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

On 28 Mar 12, media reported that the bail hearing for SLt Jeffrey Delisle is scheduled to begin today in Halifax. According to the media, SLt Delisle's lawyer, Mr. Mike Taylor, stated that the Crown is opposed to his release. On 29 Mar 12, media reported on the bail hearing of SLt Delisle and testimony by U.S. special agent James Dougherty. According to the media, Mr. Dougherty, an FBI expert in Russian intelligence and counter-intelligence, testified at the bail hearing in addition to SLt Delisle's brother, mother and aunt. Media noted that all of the testimony is covered under the terms of a publication ban, which was granted at the request of the defence. Media added that a decision on SLt Delisle's bail is expected this Friday at the earliest. On 29 Mar 12, the Toronto Sfarpublished an opinion piece regarding the allegations of espionage against SLt Delisle. According to the article, the Government is maintaining a high level of secrecy surrounding the case when there is no reason to prevent details from being released, aside from embarrassment over the incident. The article questioned whether allies continue to have "full confidence" in Canada, as stated previously by the Minister of National Defence. On 29 Mar 12, media reported that Mr. Joey Medaglia, who was under investigation for his alleged connection to organized crime, no longer works for DND as of 27 Mar. According to the media, Cmdr Hubert Genest, director of public affairs for the RCN, reportedly stated, "While Mr. Medaglia no longer works for the Department of National Defence, he is free to apply for other jobs within the federal public service. No other information can be shared about Mr. Medaglia for privacy reasons." Media added that Mr. Medaglia was an administrative assistant to RCN commander VAdm Paul Maddison. On 30 Mar 12, media reported that SLt Delisle has been denied bail. Media noted that the case is scheduled to resume on 8 May. On 31 Mar 12, media reported on speculation that secret memos warned of an espionage threat in the months leading up to the arrest of SLt Jeffrey Delisle. According to documents obtained by Ken Rubin under /Access to Information and shared with the Globe and Mail, the partly redacted summaries from 2011 reveal the prospect that NATO soldiers could be "exploited" by embassy-based Russian spies seeking to buy information. Media reported that none of the general warnings from this period appear to have pinpointed the specific threat of SLt Delisle. On 03 Apr 12, media reported on allegations that a CF soldier convicted of sexual assault was given a sentence that was too lenient. According to the media, the sentence of six years was in part a result of arguments that he suffered from PTSD. On 10 Apr 12, media reported that two CF members are accused of theft and related charges are scheduled to appear in BC Provincial Court today. According to the media, reservist Ryan Verhoeks and Cory Wagner have each been charged with theft over $5,000 and a number of other charges. Media added that the charges are the result of an investigation into a break-and-enter and theft at a Nanaimo fast food restaurant on 24 Dec 11. On 18 Apr 12, media reported that a Sarnia-area woman has filed a $1.3M civil suit against military medic James Wilks and DND. Media noted that Mr. Wilks was convicted by court martial and sentenced to 10 months in jail for sexual assault while conducting health screenings of potential recruits. According to the media, the suit alleges that Mr. Wilks was not properly supervised by DND at the time she was assaulted by him in 2009. Media added that the suit also claims that DND did not follow departmental policy and failed to act on previous complaints against Mr. Wilks. On 23 Apr 12, media reported that CFB Gagetown soldier Christopher William Grinham pleaded not guilty to sexual assault in provincial court on Friday. Media noted that the trial is scheduled for 11-12 Sep 12. On 25 Apr 12, media reported on the court martial of Lt(N) Loren Pearson at CFB Esquimalt yesterday. According to the media Lt(N) Pearson pleaded guilty to assault and harassment against a female officer he was training during a deployment aboard HMCS Ottawa in 2011. Media noted that Cdr John Allsop, the ship's Commanding Officer, testified at the court martial, stating that after the assault, he ordered Lt(N) Pearson to be sent back to Canada immediately. Media reported that the sentencing of Lt(N) Pearson is scheduled for 26 April. On 28 Apr 12, media reported on the sentencing of Lt(N) Loren Pearson regarding inappropriate sexual advances towards a junior officer whom he was training while on deployment. According to the media, Lt(N) Pearson was given a severe reprimand and fined $8,000. On 01 May 12, media reported on the alleged espionage case of SLt Jeffrey Delisle and drew comparisons to the trial of US Army Pte Bradley Manning, who is accused of passing classified documents to Wikileaks. According to the media, SLt Delisle represents the more serious case, arguing that naval secrets may have been delivered to Russia over five years that could jeopardize NATO security and damage Canada's reputation. Media noted that SLt Delisle's next court appearance is scheduled for 08 May. D-4/6

-43

LEASED UNDER THE A - UNCLASSIFIED INFORMATION WULGUE EN VERTU OF. LA LA! - RENSEIGNEMENTS NON CLASS!

On 03 May 12, media reported on four members of the RCN that are accused of impersonating police officers in Nova Scotia. The next court date is scheduled for 16 May. On 07 May 12, media reported on a complaint against a solider at CFB Shilo for allegedly committing a "lewd act" on base. According to the media, the solider has not been named, because no charges have been laid at this point. On 10 May 12, media reported that DND has recalled an internal booklet after discovering that it contained a photo of convicted killer Russell Williams. According to the media, a written statement from Defence Minister MacKay apologized, stating, "This is a terrible mistake for which the Canadian Forces are truly sorry." On 17 May 12, media reported that four members of the RCN accused of impersonating police will be given the opportunity to avoid having a criminal record and will instead be referred to Nova Scotia's adult diversion program. On 22 May 12, media reported on SLt Delisle and the reasons why the Government did not disclose the alleged involvement of Russia. According to the media, Defence Minister Peter MacKay reportedly argued for a measured and nuanaced approach to the crisis, which continues to threaten Canada's relationship with its allies. On 23 May 12, media reported on SLt Delisle and speculation that American intelligence officials supplied vital information in the initial investigation that led to charges against him. Media claimed that the case has embarrassed DND, which is now attempting to restore confidence in its ability to keep secrets. On 28 May 12, media published an opinion piece by Peter Worthington regarding SLt Delisle and Canada's attempts to downplay the allegations to avoid damaging relations with Russia. According to the article, there is reportedly concern among the inner Cabinet members about how to deal with the SLt Delisle case, with Defence Minister Peter MacKay reportedly urging caution. On 06 Jun 12, media reported on international maritime security cooperation and comments by US VAdm David Buss regarding SLt Delisle. According to the media, VAdm Buss stated that despite the recent arrest of SLt Delisle on allegations of sharing classified information with a foreign entity, Canada has not lost the trust of its allies. Further, VAdm Buss reportedly stated that he expects part of the outcome of the SLt Delisle case to be that nations will review safeguards to ensure that information passed between allies is protected. On 08 Jun 12 media reported on the sentencing of Jason John Ouimet, a former soldier with the 1 Regiment Royal Canadian Horse Artillery, CFB Shilo, for five years in prison for manslaughter in the beating death of Duane John Lacquette. On 14 Jun 12, media reported on the trial of SLt Delisle and that his lawyer, Mike Taylor has received another adjournment in order to review the large volume of documents. According to the media, Mr. Taylor stated that he does not have an issue with the way prosecutors are handing over material to him although he added that, "A lot of it is blacked out for some obvious reasons I guess and I have to make a determination as to whether I want to challenge any of that information." Media noted that the case is scheduled to resume on 04 July. On 15 Jun 12, media reported that Diane Marie Larose, a former DND employee, was given probation for fraud after she attempted to request thousands of dollars for her personal account from a foreign exchange in Ottawa on 05 Oct 2010. According to the article, Ms. Larose attempted to use a promissory note that said she had full authority from CDS Gen Walter Natynczyk and Defence Minister Peter MacKay for $2M a month to fund urgent missions and disaster relief in Canada. Media noted that the manager was reportedly suspicious and that it was confirmed that this is not the way that DND does business. On 17 Jun 12, media reported on charges of child pornography against MCpl Clayton Holloway of CFB Edmonton who had been serving in Afghanistan. According to the media, MCpl Holloway has been repatriated in order to face charges under the military justice system. On 05 Jul 12, media reported that the case of Sub-Lieutenant Jeffrey Paul Delisle has been set over until 17 Jul 12 owing to his lawyers asking for more time to analyse material that had just been disclosed by the Crown. On 10 Jul 12, media reported that the Canadian Forces sergeant Christian Boudreau has been demoted to corporal and faces dismissal from the military after he was convicted of five counts of breach of trust and five of behaving in a disgraceful manner regarding inappropriate medical examinations of female recruits from 2003 to 2009. On 17 Jul 12, media reported that Canada has no interest to try SLt Jeffrey Delisle publicly, as it is not in Canada's national security interest to expose publicly what happened and how it happened. The article mentioned that the lawyers in this case are expected to meet in court again that day. On 18 Jul 12, media reported that SLt Jeffrey Paul Delisle's lawyer asked that his client be tried in front of both a judge and a jury. It was reported that the preliminary investigation could start in autumn 2012 or in winter 2013.
D-5/6

44

lASS> UNDER THE A1A - UNOASSIRED INFORMATION IVULGUE EN VERTU DE LA IAI - RENSEIGNEMENTS NON O

On 19 Jul 12, media reported that Col Bernard Ouellette, who was dismissed from his command in Haiti two years ago amid allegations of an inappropriate relationship, is suing the Department of National Defence and fellow officers for defamation. Col Ouellette reportedly denied any wrongdoing and is seeking $6.2M in damages as well as an apology and a correction to his service record. On 19 Jul 12, media reported that the preliminary inquiry in SLt Jeffrey Delilsle's trial will start on 10Oct12. On 19 Jul 12, media reported that CF member Jamie Espirito-Santo has been sentenced to four months in jail for an assault that left a stranger with a broken jaw and several other injuries On 20 Jul 12, media reported that a Beamsville artist formerly accused of impersonating a military officer has launched a S7.8M civil suit against the Minister of National Defence, because he claims that he is a military officer and had not been paid for close to 20 years' work as an undercover agent gathering intelligence for the military and the RCMP. It was reported that Canadian Forces officials admitted the artist enlisted in the military in 1990. On 20 Jul 12, media reported that the Canadian Forces Grievance Board ruled in December 11 that Gen Walt Natynzcyk, the Chief of the Defence Staff, should compensate Col Ouellette for his lost benefits, take steps to restore his reputation and put him back on his previous career path. Col Ouellette was stripped of his command in Haiti for allegedly having an inappropriate relationship. Gen Natynzcyk has reportedly not yet responded to the grievance board's recommendation. On 25 Jul 12, media reported that Australian officials, including the Australian High Commissioner to Canada Louise Hand, were briefed by the Canadian government on the activities of SLt Jeffrey Delisle shortly after his arrest for espionage in January. Media added that the Australian Security Intelligence Organization was also briefed on SLt Delisle's case by the Canadian Security Intelligence Service. On 25 Jul 12, the Edmonton Sun published an opinion piece by Peter Worthington that noted the lawsuit launched by Col Bernard Ouellette against DND over his dismissal from command in Haiti after allegations of inappropriate behaviour with a UN official. On 26 Jul 12, media reported that highly classified intelligence from Britain, Australia and New Zealand may have been compromised by SLt Jeffrey Delisle. According to documents released under Australian freedom of information laws and reported on in the Sydney Herald, SLt Delisle had access to the 'Five Eyes' intelligence and the leak resulted in high-level consultations between the Australian and Canadian governments, as well as a secret international conference in New Zealand earlier this year. Media speculated that the breach has damaged Canada's security relations with some of its key allies, while Canadian security experts Martin Ruder of Carleton University and Christian Leuprecht of the Royal Military College and Queen's University reportedly suggested that the case is unlikely to cause much of a rift among allies. On 30 Jul 12, media reported that a solider at CFB Shilo was shot early Sunday and that another solider is in custody following an altercation at CFB Shilo. According to the media, the solider who was shot reportedly suffered non-life threatening injuries and that the used weapon is not a military-issued weapon. Media added that the incident is being investigated by the CF National Investigation Service but that no charges have yet been laid. On 31 Jul 12, media reported on charges of attempted murder and weapons offences against MCpl Clarence Joseph Stillman of CFB Shilo in connection with the shooting of another soldier at CFB Shilo on 29 July. According to the media, the CF National Investigation Service is investigating. Responsible Principal(s): VCDS, SJS, CMP, JAG Contacts: LCol Peter Allan, EA/VCDS, 992-6055 Maj Stewart Taylor, EA DOS SJS, 996-8396 Cdr Mary Gardam, SA/JAG, 996-8998 John Roche, SA/CMP, 943-6815 Capt Kevin Winfield, EA/CFPM, 949-1021 LCdr Jordan Holder, PAO/ADM(PA) SJS, 992-9049

Joanna Hruskoci (D Parl A 2-4) 992-1022 Summer 2012

D-6/6 AU383244 45-A-2012-01720 - 45

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION

mnex E
100-1 (SIMAT) SIMAT REPORT 8Sep12 National Oelenca Defense nationals

MEDIA MONITORING & ANALYSIS SUM

21 JAN-30 APR 12; 9 M A Y - 5 SEP 12

:iat ra VERTU DE LA LAI - RENSEIGNEMENTS NON OASSIFII

Media Monitoring and Analysis - ADM(PA) 30 April 201 2

Surveillance et Le30avril2012

SLT JEFFREY PAUL DELISLE

Canadian media coverage

ENS 1 JEFFREY PAUL DELISLE

Couverture mediatique canadienne Main themes / Fails sail lants : " 173 articles (151 English, 22 en francais) were .published. in domestic media from 21 January to ; 30 April 2012, regarding SLt Jeffrey Pa'ul Delisle and issues surrounding espionage; o Seven articles were published in international media; . -- Ourinc|1he frionit6redlpefibd,1he journalists that generated the most coverage on the issue were: - ; . Sleveh Chase and Colin Freeze (Globe & Ma//, 4); Michael Tuttbn (Toronto Star, 4); Steve Bruce (Halifax Chronicle-Herald, tyJeti Daws (Postmedia, 4); and PeterWorthirigton (Sun Media, 3) Editorial cbmrnentery^iBpreserrted "9 per cent' of total coverage (17 itenis)vThe overall tone of ' : ^ secrets^'-Oelisie could have ' ' ' been ' ' ' privy to; Executive Summary / Sommaire executive On 17 January, several Canadian news sources reported on the 13 January arrest of SLt Jeffrey Paul Delisle. Postmedia,' CP, the Globe and Mail. QMI, the Halifax Chronicle-Herald and the Fredericton Daily Gleaner noted SLt Delisle was charged with communicating information that may "increase the capacity of a foreign entity or a terrorist group to harm Canadian interests." The articles indicated the Navy Intelligence Officer is the first person to be charged under the Security of Information Act, which came into effect in 2001 as part of a package of anti-terrorism laws. On 18 January, the Kingston Whig-Standard and the National Post indicated SLt Delisle was reportedly passing information to Russia, however, DND never confirmed which entity allegedly received the material. On 19 January, a CP article noted CDS Gen Walt Natynczyk made his first public comments on the case. In a written statement, he maintained the military takes the security of sensitive information very seriously and is always mindful of the effects of leaks. On 21 January, a Postmedia article reported authorities fed SLt Delisle fabricated information as part of a "sour milk" counter-intelligence ploy to taint the credibility of secrets he was suspected of passing to Russia. The article noted once naval officials suspected there was a spy in their midst, deliberately flawed information was baited and designed to eventually be discovered by its foreign recipients. Michel Juneau-Katsuya, a former intelligence officer with CSIS, said the deception is believed to have worked and now "they don't know what is true and what is not and will have to be suspicious of pretty much every thing [given to] them." He added, "This was done by the book - sour milk so that you confuse the other side." In March, the Globe and Mail's Colin Freeze and the Wall Street Journal published articles indicating the case of SLt Delisle has done significant damage to Canada's relationships with key allies, mainly the U.S. The WSJ

A0383

RELEASED UNDER THE AM - UNCLASSIRED INFORMATION DMJLOl EN VERTU DE LA LAI - RENSHGNEMENTS WON CLASSIFIES

article reported details regarding what information was leaked have not been made public, but the article claimed a source familiar with the matter said it was "military signals information, or electronic communications coming from allied and other state militaries and it was leaked to the Russians." Articles published in the Toronto Star and Postmedia reported on the WSJ article, noting a fallout between the U.S. and Canada caused by the leak of information, was "downplayed by Canadian officials." Jay Paxton, a spokesperson for MND Peter MacKay, stated: "I can't speculate on hearsay. The minister has been clear that our allies remain fully confident of Canadian defence activities. That point was reiterated by the visit of Minister MacKay's American and Mexican Counterparts." The Star added leaked information by SLt Delsile reportedly touched on a system viewable by the Five Eyes, an intelligence alliance between the U.S., U.K., Canada and New Zealand. On 31 March, the Globe and Mail reported in the months before the espionage arrest of SLt Delisle, the military quietly circulated "secret" memos warning against growing spy threats, including the prospect that NATO soldiers could be "exploited" by embassy-based Russian spies seeking to buy information. According to the article, "the Canadian Forces unit noted that the defence attache - who had been expelled - was (like most Russian defence attaches) presumed to be a member of the Moscow-based military spy service known as the GRU." During the monitored period, several articles were written regarding SLt Delisle's lawyer, Cameron MacKeen, withdrawing from the case in January and on the rescheduling of his many bail hearings. On 31 March, the Charlottetown Guardian reported Judge Barbara Beach turned down SLt Delisle's application for bail. Canadian Intelligence Centres / Centre d'intelligence canadiens In early January, the Halifax Chronicle-Herald published two articles describing HMCS Trinity Communications Centre. A 28 January article published in the Globe and Mail noted HMCS Trinity stores some of the most "sensitive" military intelligence available in Canada and collected by international allies as well. The National Post published an article on 18 April, discussing the history, growth, and workings of CSEC. The article noted CSEC is thought to have played a role in catching Sit Delisle. On 19 April, the Fled Deer Advocate published an article discussing the closure of the Acoustic Data Analysis Centre at CFB Esquimalt. The article mentioned the operations will be transferred to a similar centre in Halifax. Arctic Espionage / Espionage dans I'Arctique According to an article published in ten Postmedia dailies on 18 January, SLt Delisle's case could be connected to an ongoing territorial dispute in the Arctic. According to Michel Juneau-Katsuya, SLt Delisle's duties in Halifax included monitoring the North Atlantic seas. Juneau-Katsuya added SLt Delisle had access to sensitive information, including the locations of ocean sensors that help monitor ship movements. In a Sun Media article, Rob Huebert, a naval and defence policy teacher at the University of Calgary said Canada's Arctic is "ripe for spying." The article noted Canada is developing enhanced land and sea satellite surveillance capabilities alongside the Northern Watch project, a combination of surface, underwater and space-based sensors that will-give Canada a better ability to monitor the region. According to Huebert, the project is "highly sensitive" and therefore of interest to those involved in the world of espionage. Russian diplomats / Diplomates russes Following SLt Delisle's arrest, several articles were published regarding the expelling of staff members at the Russian embassy, including several diplomats. Although Canadian governmental officials refused to comment on the issue, articles noted the staff members weren't expelled, but at the end of their terms and scheduled to leave "weeks and months before the charges were laid." On 10 February, the Globe and Mail, Postmedia. the National Post, the Toronto Star, Global News and AFP reported Georgiy Mamedov, Russia's ambassador to Canada, indicated Moscow has an agreement with the Canadian government to "keep quiet" about any connection between Russia and the case of SLt Delisle. According to the articles, while talking to CTV's Robert Fife, Mamedov maintained, "I have a deal with your people to keep quiet, but after this seal of silence is lifted, I will tell you and you will be red-faced." Following the allegations SLt Delisle was spying for the
SLt Jeffrey Paul Delisle Ens 1 Jeffrey Paul Delisle 2

A0383244 47-A-2012-01720 - 47

RELEASED UNDER THE AIA - UNCLASSIRED INFORMATION DMJLGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CUSSIHE

Russians, Mamedov said, "I don't know because I am not the guy who controls Humint [human intelligence]. But I can tell you that what you have said about some people in my embassy are dead wrong." According to CTV.ca, Mamedov also suggested it is possible Russia's role in the SLt Delisle case will never be known, "It will depend on the entire interests of our bilateral relations because you are interested in good relations with the Russians... so I am working for you as much as for my taxpayers." Other/Autre The Globe and Mail published an interview with SLt Delisle's former wife Jennifer Delisle. In the interview she discussed her former husband's activities and hobbies. According to Ms. Delisle, SLt Delisle "admitted he had a computer addiction problem," that he was "hooked on medieval and military history" and "would spend large amounts of money on his medieval fantasy games. Editorial coverage / Couverture editoriale An opinion piece by Peter Worthington published by Sun Media on 12 January, questioned what "secrets" SLt Delisle could be giving the Russians. Worthington argued: "We don't have much of a navy these days, and telling the Russians which dry dock our four aging submarines are being repaired in can't be much of an espionage coup." The author went on to state that the damage caused to the U.S. and our allies by SLt Delisle is "of the embarrassing kind, and unlikely to undermine or expose operational plans." An opinion piece printed in the Toronto Sun also questioned what secrets SLt Delisle would be able to "spill." The author stated: "What beans would he have to spill? The secret ingredients in a beavertail? The Leafs' next starting goalie? Rob Ford's new diet?" A 29 January editorial in the Toronto Star drew parallels to the piece by Worthington, with the author stating: "I believe it is unlikely that a junior intelligence officer would be privy to the kind of secrets that could cost lives or irreparably damage Canada's strategic alliance." Contrary to the opinion expressed by Worthington, a second editorial in the Toronto Star argued that despite reassurances by the federal government and MND Peter MacKay, the charges against SLt Delisle are a "blow to our credibility" and that there is "no point in denying it." A column by Scott Taylor published in the Halifax Chronicle-Herald on 23 January, stated that what started as a "rather minor news story about a navy intelligence officer charged with espionage has developed into a fullfledged, nation-wide media feeding frenzy." Taylor noted that since little information has been made available about the case against SLt Delisle, intelligence experts, legal advisors and journalists have been "asked to speculate about the implications of the events," and that as such the "worst doomsday scenarios have become the accepted norm." Taylor added that stepping back, one may realize that SLt Delisle has "only thus far been charged - not convicted - and we still have no idea what sort of information he leaked." A second opinion piece in the Halifax Chronicle-Herald echoed Taylor's argument, stating SLt Delisle is "an accused spy, not a proven one." The piece added, "even in this era of national insecurity, SLt Delisle has the right to presumed innocence and a fair trial."

SLt Jeffrey Paul Delisle

Ens 1 Jeffrey Paul Delisle

A0383244 48-A-2012-01720 - 48

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION D1VULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

* **

<

Social Media/Mediae Sociaux On 28 March, a blog post on War News Update also picked up on the article in the Wall Street Journal. It was mentioned SLt Jeffrey Delisle allegedly "leaked a large cache of military communications data" to Russia, reportedly causing a "serious breach between U.S. and Canadian intelligence officials." The author claimed the fallout underscored the "seriousness with which Washington has taken the incident despite Canadian insistence that allies haven't been overly concerned."
This document is for internal use only. / Ce document est reserve a des fins internes seulement. For more DND/CFnews information, please visit the ADM(PA) News Room at http://media.mil.ca/index.asp?Lana=E. Pour obtenirplus d'information sur les actualites relatives au MDN ou aux FC, veuillez visiter la Salle des nouvelles du SMA(AP) a http://media.mil.ca/index.asp?Lanc/=F.

SLt Jeffrey Paul Delisle

Ens 1 Jeffrey Paul Delisle 4 A0383244 49-A-2012-01720 - 49

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

Media Monitoring and Analysis - ADM(PA)

11 September 2012

Le 11 septembre2012

SECURITY
Canadian and International media coverage

SECURITE
Couverture mediatique canadienne et internationale Main themes / Faits sailfants : 131 Articles ;;(aH English) were published ;:in domestic and, international media; with regard to issues surrounding Security and ^espionage for the period 9 May -5 September 2012; ;i;;;" : =; s; J' ; ^;--o&67 articles were published in domestic ifiedia and 64 articles were found in international media. 'Thevmain themes covered over the monitoredI period^ were:;:U.S. Secret ;Service misconduct issue in Colombia; U.S. intelligence officials providing information that resulted in the arrest of SLt Delisle; the U.S. congress launches -an '.investigation into the" recent leaks of U.S. classified intelligent information to the media;- U.S/?federai authorities investigate public ^disclosure of classified national security information; the leak of classified documents by SLt Delisle compromising Britain and Australia's intelligence "organizations; and former U.S. Navy Seal Matt ' Bissonnette's book "No Easy Day" triggers controversy among White ' : i Five comment piecesVwerepublis^ discussed the lack of QxtunforrTiation Ir^hefmed spying'v and;;an / ; commentary piece by Colin Kenny discusses+iow Canada defends its costal vyaters. ;:;'-""- - v f ^ v ; 27 blpg postsTvyere publish^ Secret Service was quick to investigate the prostitutjoh-and-misconduct scandal in Colombia; the process of gaining security clearance; Matt y Bissonnette was worried .'. about security after" the raid the "killed bin laden; and President Obama's ,; administration -aides providing Holly\wood producers unprecedented access to details and classified .-;;:;: information regarding the killing of bin Laden. /"^; i ;; ; v .: . ' ^ :t i :S Print and online media coverage / Couverture des medias imprimes et en ligne National Security / Securite nationale On 4 May Reuters reported the military officer responsible for investigating the misconduct issue in Colombia completed his inquiry and forwarded the findings and recommendations to the head of the U.S. Southern Command (SOUTHCOM) for action. The Ottawa Citizen ran an in-depth story by Meghan Hurley on 14 May regarding Joey Medaglia, whose job with DND was terminated because of his friendship with the late Graham Thomas, a convicted drug dealer with past criminal ties. Articles by the Washington Post and AP on 23 May reported four secret service employees have decided to fight their dismissals for engaging in inappropriate conduct in Colombia last month.

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION

On 8 June the Baltimore Sun reported Rep. C.A. Dutch Ruppersberger and the other leaders of Congress' intelligence committees issued a statement of condemnation for recent leaks of classified information about America's clandestine operations abroad. The Toronto Star published a commentary piece on 17 June discussing the Harper government's announcement of the new head of CSIS. On 23 July the Los Angeles Times reported leaks of confidential government information are "nothing new in Washington." But a recent spate of news stories about national security operations has emboldened advocates of new punishments for revealing classified information.

National Security / Securite nationate

May

June

July

August

Septerrber

The Washington Post published a commentary piece on 29 July discussing the U.S. government's system of classifying documents. Postmedia published an AP article on 4 August reporting a military investigation into the secret service prostitution scandal has concluded "the combination of unstructured free time, the prevalence of legalized prostitution and military members' individual choice to commit misconduct," were the primary causes of the transgressions. The Times (UK) reported on 13 August NATO is "overhauling" its security procedures after the discovery of two spies in Germany who downloaded top-secret data from computers. On 24 August several sources including The New York Times and AP reported the U.S. Defence Department said Navy Seal Matt Bissonnette who authored the book "No Easy Day," which gives a "blow-by-blow" narrative of the assault on Bin Laden's compound in Pakistan in May 2011 had violated department regulations. On 2 September several media outlets including the Toronto Star, AP, and the Detroit Free Press reported the book "No Easy Day" had triggered a "firestorm of controversy" over the official White House version of Bin Laden's death. SLt Jeffrey Paul Delisle / Ens 1 Jeffrey Paul Delisle On 22 May a CP article by Murray Brewster reported that according to a series of internal briefings, the government had a "host of military and possibly commercial reasons" for not blaming Russia in the aftermath of the spy scandal revolving around SLt Delisle. The Globe and Mail reported on 23 May that American intelligence officials supplied vital information in the early days of the investigation which resulted in the arrest SLt Jeffrey Delisle.

Security

Securite 2

A0383244_51-A-2012-01720 -51

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

On 28 May several QMI newspapers published a commentary piece by Peter Worthington discussing a 22 May CP article that suggested Canada is downplaying the espionage case against SLt Jeffrey Delisle for fear of upsetting relations with Russia. Articles by The Chronicle-Herald, Metro Halifax and CBC.ca published on 5 June reported on the 2012 Maritime Security Conference in Halifax, during which U.S. VAdm David H. Buss said the case of SLt Jeffrey Paul Delisle had not diverted NATO's members from the course of increased information sharing, or "shaken" NATO allies' trust in Canada. On 14 June CP reported Mike Taylor, the lawyer for SLt Jeffrey Delisle, said the information he has received had been redacted because of security concerns. The National Post published a commentary piece August July June September on 22 June discussing how Canada defends its costal waters, highlighting the importance of Trinity and Athena for monitoring Canada's costal waters and noting their vulnerabilities. On 3 July an commentary piece by Senator Colin Kenny published in the Ottawa Citizen stated that "useful surveillance work" is being done by various branches of Canada's defence community but the technology being provided to them to do their jobs is "antiquated" compared to what NORAD uses to defend Canada's air space. The Sydney Morning Herald and QMI reported on 25 July the case of alleged Canadian spy SLt Jeffrey Paul Delisle, who compromised Australian intelligence information "in an espionage case that has sent shock waves through Western security agencies." On 26 July the National Post, QMI and PostMedia reported, according to the Sydney Morning Herald, the spying allegations against SLt Jeffrey Delisle are "causing ripples" in Australia and Britain, with unconfirmed media reports suggesting intelligence supplied to Canada by some of its key allies was compromised in the case. Espionage / Espionnage On 1 June Reuters reported a Chinese state security official had been arrested on suspicion of spying for the United States. On 26 July the Canberra Times and the Sydney Morning Herald reported U.S. allies such as Canada and Australia are primary targets for espionage. Postmedia published an AP article on 8 August reporting a 60-year-old German civilian who worked at NATO's air command headquarters in Germany had been charged with stealing secret data.
SLt Jeffrey Paul Delisle / Ens 1 Jeffrey Raul Delisle

Security

Securite

A0383244 52-A-2012-01720 - 52

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION

June

July

August

September

WikiLeaks On 28 May the Sydney Morning Herald reported Australian diplomats closely monitored the U.S. Department of Justice investigation into WikiLeaks over the past 18 months with the embassy in Washington reporting that "a broad range of possible charges are under consideration, including espionage and conspiracy." On 26 June Aqence France Presse reported a US military judge ordered prosecutors to show they are not withholding evidence from WikiLeaks suspect Pte Bradley Manning after defence lawyers accused them of hiding documents that could potentially help their client's case. The UK Guardian reported on 16 July the U.S. government claims to have proof that Pte Bradley Manning knowingly passed state secrets to a location where it was likely to be obtained by enemy groups. On 19 July the AFP reported a US military judge ruled that WikiLeaks suspect Pte Bradley Manning will not be allowed to cite evidence at his trial, alleging he caused no serious harm to the U.S. when he released secret government documents. Social Media / Medias sociaux
May June July August September WikiLeaks

WBOB Radio reported on 7 June top Democrats and Republicans demanded an end to leaks of classified intelligence because, they said, the leaks were putting lives at risk and jeopardizing future operations. In a blog post on 10 June Christopher B Daly of Journalism Professor discussed the legal definition of a national security leak.

Security

Securite

A0383244_53-A-2012-01720 - 53

RELEASED UNDER THE A - U (CLASSIFIED INFORMATION DIVULGUE EN VERTU DE U LAI - RENSE1GNEMENTS NON CLASSIFIES

Social Media / Medias sociaux

On 14 July a blog post on Spy Eyes News reported WMR's Syrian sources were convinced the massive release of files from Syrian computer networks is further proof that WikiLeaks is a CIAand Mossad-linked operation designed to target other nations while maintaining "plausible independence" from U.S. and Israeli intelligence agencies. In a blog post on 19 July Military Ring Info reported the defence attorney for Pfc Bradley Manning is making the argument that the soldier should not be charged with electronic break in of government computers because he had a security clearance and did not have to do anything special to steal the information that he gave away. On 21 July a blog post on Sanity For Superheroes discussed the topic of security clearance. The blog defined security clearance as "an inquiry into an individual's loyalty, character, trustworthiness and reliability to ensure that he or she is eligible for access to national security information."
May (N/A)

June

August

September

On 5 August a blog post on The Steady Drip discussed the process of gaining security clearance. The blog Duhur reported on 1 September the author of "No Easy Day" Matt Bissonnette is worried about security after the raid that killed Osama bin Laden. A blog post on SHTFPLAN published on 1 September reported President Obama's administration was so desperate to "look righteous and heroic" in the eyes of the American public following the raid that killed Osama bin Laden they went so far as "to support the production of a new movie detailing their version of the story." 7776 following graph represents the number of articles published per month

National Security / Secuirte Nationale

SLt Jeffrey Raul Delisle

Espionage / Espionnage

Wikileaks

Social Media / Medias sociaux

This document is for internal use only. / Ce document est reserve a des fins internes seulement.
For more DND/CF news information, please visit the ADM(PA) News Room at http://media mil.ca/index.asp?Lanq=E. Pour obtenir plus d'information sur les actualites relatives au MDN ou aux FC, veuillez visitor la Salle des nouvelles du SMA(AP) a http://media.mil.ca/index.asp?Lar>Q=F.

Security

Sec u rite 5

A0383244 54-A-2012-01720 - 54

SECRET

o
CM C-

9
CV)

Annex F 2100-1 (SIMAT) SIMAT Report 28Sep12

o
CN 10 IO

Security Realignment: How we are going to do it

The Defence Security Programme, align auth, resp, accountabilities, & respurces (ARA & R) Approach, use a centralized auth model that includes inspections, audit & compliance
Increasingly functional secur model ARA & R

oo

CO

Process

"preconditl ons" for enduring effect

f-

Culture

Ph 1: "IOC'

Ph 2: "FOCJJ Ph 3: Validate & Adjust

Lines of Operation (LOO) GoC (DSO): Legislation, Policy, Governance, & Oversight

Security Risk Management

Security Controls
defence security model

Security Programme Monitoring

Security Priorities, Initiatives & Implementation

Jan '13 Jul '13

Time Estimate
Identify new security gaps Refine CONOP for security realignment and MAP 8. Write Defence Security policy (8a), and Defence Security Plan 9. Develop Master Implementation Plan (MIP) 10. DMC- endorse way-ahead (CONOP/MIP) 11. Defence Security Policy Is promulgated 6. 7. 12, Initial realignment of structure / C2 (IAW CONOP and MIP). Improvement In LOO, 13, Defence Security Manual Is promulgated 14, Final reorganisation is completed (IAW CONOP and MIP), Steady-state in LOO. 15, Validate efficacy of ARA & R (process is an annual cycle, aligned with Bus Planning) 16, Adjust Defence Security Programme

Legend

1. Conduct initial Aggregated Risk Assessment 2. Conduct policy gap analysis 3. Establish Defence Security Policy (3a)/ Plan /Manual frameworks 4. Assumption: staff actions complete (ref: DSX Decision Brief - 22 May 2012) 5. Validate Initial security capability gaps ("Tiger Team" results from Feb, 2012)

F-1/1 SECRET;

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATION DIVULGU EN VERTU DE LA LAI - RENSH6NEMENTS NON CLASSIFIES

SECRET Annex G 2100-1 (SIMAT) SIMAT REPORT 28 September 2011

List of Referenced Documents (Released Under Separate Correspondence) A. B.

C. D. (SI

(S; 27 January 2012

DSO Review of "Tiger Team Delisle" Results,

(UNCLAS) Canada COM COMD 002/12 081952Z MAR 12 Force Protection Tasking Order, 8 March 2012

E.
F.

(S//CEO) CRS Draft Report - Audit Follow-Up - Departmental Security Program Implementation and Security-Related Audits, 31 May 2012
(TS,

G. H.

(TS 3EO) Summary of Findings - GDI Damage Assessment Team Activities of Sub-Lieutenant J.P. Delisle, 7 June 2012 (S/i 21 June 2012 DSO Information Brief: Realigning Security in DND,

J.

G-1/1
SECRET
A0383244 56-A-2012-01720 - 56

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUg EN VERTU DE LA LAI - RENSHGNEMENTS NON OASSIFII

SECRET
Director Defence Security Directeur S4curit6 de la defense

Review of "Tiger Team Delisle" Results:

Col RM (Rod) Lander Departmental Security Officer (DSO) 1

Director Defence Security

Directeur Securite de la defense

Agenda Background: Mandate & Composition of Tiger Team Linkage to Aggregated Risk Assessment (ARA) presented to DAC, Dec 2011

Black Swan event...or not Tiger Team-Results Deficiencies and Recommendations Accountability and Responsibility: Reconsidering the Role of DSO / DOS Resources Recommendations Conclusion

A0383245 1-A-2012-01720 - 57

RELEASE) UNDER THE A1A - UNCLASSIFIED INFORMATION DIVULGU EN VERTU DE LA LAI - RENSEK3NEMENTS NON OASSIFII

Director Defence Security

Directeur Sscurite de la defense

Background

Damage Assessment ongoing "Tiger Team Delisle" stood-upto consider:

1. What went wrong? 2. What should have been done under present org/processes? 3. How can we improve security for the future to mitigate risk and improve process?

Tiger Team Reps

DSO
Dir IM Secur

CF MP Gp
GDI

Restraint: Tiger Team Members will not be read into file. Invest and Damage Assessment ongoing Therefore: observations and recommendations are with a view to systemic issues that *could have*; or likely *would have* contributed to vulnerabilities to the Delisle espionage case

Aggregated Risk Assessment: Executive Summary Slide

(presented at the Defence Audit Committee (OAC) - 8 Dec 2011)

Security: Core Elements and Enablers

Extreme

a: a
High Medium

Low

Bottom line: vulnerabilities in various domains aggregated to allow for threat to be realised

SECRET

A0383245 2-A-2012-01720 - 58

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DWULGUE EN VERTU DE LA LAI - RENSBGNEMENTS NON CLASSIFIES

Investing in security and the Aggregated Risk Assessment (ARA) Ideal Typical Cost Benefit of Security1

Cost of Risks

Predicted cost of risks with no controls Cost of managing and controlling risks identified

Time The ARA assists in identifying risks; a first step to improvement

1

Bottom line: security control measures provide a good return on financial investment

"Freehand representation" from University of Leicester (UK) (2001) - Risk Management Module - MSc in the Study of Risk, Crisis and Disaster Management: source data from UK Home Office

Black Swan1 Security Events: Low Probability / High Consequence

Cost Benefits of Preparing for Black Swan Events

Cost of Risks

Modest expenditure for 'Black Swans" Time

Preparing for a catastrophic [Black Swan] event improves ability to respond to other significant unknown events; organisational resilience
1

Taleb, Nassim N. (2010) The Black Swan, New York: Random House Publishing, Inc.

A0383245 3-A-2012-01720 - 59

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION PMJLGUg EN VERTU DE LA LAI - RENSBGNEMENTS NON CLASSIFIES

SECRET Tiger Team Observations/ Recommendations

Deficiencies

Recommendations

SECRET

SECRET Tiger Team Observations / Recommendations

: ' ^ | v'l:''*

Deficiencies

:.
*

Recommendations

^ |

(see next slide)

SECRET

A0383245 4-A-2012-01720 - 60

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION DIVULGUE EN VERTU OE LA LAI - RENSHGNEMENTS NON CLASSIFIED

SECRET Accountability and Responsibility: Reconsidering the Role of DSO / DOS - "One dog to kick" [the GoC DSO model] Status Quo (Extant Funct Auths remain) Functional Auth Model Staff-centric Command Auth Model "Defence Security Agency"

Note: (<Formation>) = losing formation SECRET

Resources: Recommendations (1/2)

SECRET

Functional Auth: staff-centric model Existing Owner Proposed Change Comments

1 SECRET

10

A0383245 5-A-2012-01720 - 61

RELEASED UNDER THE AW - UNCLASSIFIED INFORMATION DMJLGUg EN VERTU OE LA LAI - RENSEIGNEMENTS NON OASSIFI&

Resources: Recommendations (2/2)

SECRET,

Command Auth: "Defence Security Agency" model

Existing Owner Proposed Change Comments

Technology Requirements (regardless of options considered)

'vt TBD following cross-validation with SSC mandate

SECRET

11

SECRET
Director Defence Security Directeur Securite de la defense

Conclusions

Regardless of org recommendations, resources are required to fill security gaps Non-DND security services providers (eg CSIS, RCMP) do not have an indepth knowledge of military strategic issues CDS and DM are responsible for Defence Security

We must optimise DND to support national security requirements

12

A0383245 6-A-2012-01720 - 62

RELEASED UNDER THE AIA - UNCLASSIRED INFORMATION D1VULGU EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIES

Director Defence Security

Directeur Securite de la defense

Errata: changes since VCDS/DOS SJS Briefings (27&30 Jan 2012)

National D&fensw

A0383245 7-A-2012-01720 - 63

DMJLGU EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFY

SECRET
BRIEFING NOTE FOR THE MINISTER SUMMARY OF CURRENT SECURITY ISSUES ISSUE 1. The intent of this BN is to ensure the Minister is aware of several ongoing security issues impacting DND at the strategic level. BACKGROUND 2. Ongoing security issues have impacted or have the potential to impact DND strategically. This BN contains a summary of the most significant issues known to the Departmental Security Officer (DSO), the potential impact and status of any investigation. DISCUSSION 3. Delisle Affair: This incidence of alleged espionage is being investigated by the RCMP and CSIS and dealt with in DND by an ad hoc Security Issues Management Action Team, the deliberations of which have exposed several flaws in the extant security programme including: All of the details and associated recommendations will be included in DOS SJS generated reports (Interim Report to be issued in May 12). ONGOING 4. Detected Security Breach - Op ATHENA:

s'15(1)

is being investigated by MP. The containment and sanitization activities are being undertaken by an ad hoc interdisciplinary Task Force (TF) stood up by the VCDS.

5. New Defence Campus: The public announcement that NDHQ will occupy the former Nortel Campus on Carling Avenue years before the site can be appropriately delineated and secured as a Defence Establishment is a major issue. This not only raises the level of difficulty of verifying appropriate security safeguards in the future, it will probably dramatically increase security costs and cause delays to reach full operational capability. An adequate industrial/corporate security component to the Defence Security Programme could have prevented this issue through effective coordination with PWGSC and TB while the site acquisition was underway. ONGOING 6. NATO Inspection: Canada was subject to an inspection by the NATO Office of Security 19 -23 Sep 11. The results highlighted several areas where DND was non-compliant with minimum security requirements. These areas are being addressed by the stakeholders, but the inspection results could have been improved by a comprehensive, enforceable compliancy regime at the departmental level. ONGOING 7. North Bay Above Ground Complex fNBAGC): Several issues with respect to the NBAGC were highlighted by OAG and CRS audits since 2007. These could have been prevented with adequate enforcement of extant policy concerning acquisition and construction.

1/2 SECRET
A0383246 1-A-2012-01720 - 64

DIVULGE EN VERTU DE LA LAI - RENSSGNEMENTS NON CLASSIF1

8.15(1)

SECRET

s.21(1)(a)

A follow-up audit of Industrial Security by OAG is currently underway. ONGOING 8. Issues related to Canadian Secret Network Infrastructure (CSND: CSNI is the primary operational network for the CF.

9.

10. Miscellaneous Incidents of Poor Security Practices: There are currently several miscellaneous security investigations ongoing that could have serious implications. In another case, a DND senior executive left SECRET CEO and Cabinet Confidence documents inappropriately secured in a private vehicle from which they were stolen. Fortunately in this case, the documents were recovered quickly and apparently were not compromised. All of these incidents are under investigation by MP or the DSO and highlight the evolved prevalence of poor security practices over the years and the requirement for dramatically improved security awareness, education, and training in DND in order to improve the overall security culture. ONGOING CONCLUSION 11. As a result of the state of security which has contributed to the incidents summarized above, the VCDS directed that a Management Action Plan (MAP) option presented by the DSO be further developed. This option proposes to align the functions of the DSO with those in other government departments and consolidate all aspects of security within DND into one organization, tentatively entitled the Defence Security Agency. This proposal envisions a holistic and synergistic approach to a revitalized Defence Security Programme that will have the requisite balance of responsibility, authority and accountability to be both effective and efficient. This MAP is expected to be briefed to the VCDS before the end of April, followed by CDS and DM engagement. Prepared by: R.M. Lander, Col, DSO, 943-7532

Reviewed by: C.A. Lamarre, BGen, DGO SJS, 996-8875 Responsible Group Principal: J.H. Vance, MGen, DOS SJS, 992-3355 Date prepared: Apr 12

2/2 SECRET

A0383246 2-A-2012-01720 - 65

KCLCM3CL* unuCII I HE M 1 H - UIVLLMDSiri CU mrUKTlM I

SECRET (LIMDIS) BRIEFING NOTE FOR CDS AND DM SUBJECT: HALIFAX FOLLOW-UP (DELISLE CASE) ISSUE

WVULGUE EN VEKHJ DE LA LAI - RENSEK3NEMENTS NON CLASSIFI*

s.isn)

1. Particulars associated with the investigation and subsequent prosecution of Sub-Lieutenant J.P. Delisle have resulted in extensive departmental efforts to contain, mitigate and resolve extant and potential vulnerabilities within National Defence's security and intelligence apparatus.

BACKGROUND
2. On 9 December 2011, the Canadian Forces Provost Marshall advised the Commanding Officer, CF National Investigation Service (CO CFNIS), of a "very close hold" national security investigation underway involving a Canadian Forces member. CO CFNIS was directed to contact the Director General National Security (RCMP) for a briefing, from which to determine how the CFNIS could best support the investigation. 3. On 13 December 2012, CO CFNIS was fully briefed on the particulars concerning the investigation by the RCMP (itself leading to formal charges under the Security of Information Act being laid against Sub-Lieutenant Delisle on 16 January 2012). Since the initial notification, CO CFNIS has remained the principal Canadian Forces and departmental link to the RCMP investigation, while GDI has served as primary responder and coordinator in addressing the immediate security and intelligence ramifications of this incident. On 27 January 2012, departmental oversight was transferred from GDI to DOS SJS, who is discharging this responsibility through the newly-established Security Issue Management Action Team (SIMAT). DISCUSSION 4. Departmental efforts in response to this incident have been extensive and comprehensive. While initial actions continue, concurrent coordinated activities are being undertaken to enable the Department to transition from its initial "reactive" posture to more extensive, comprehensive interim and long-term oversight and management. Key aspects of these efforts are provided herein. 5. Technical. Since notification of the incident and as coordinated through GDI on behalf of ADM(IM), the Canadian Forces Network Operations Centre (CFNOC) (part of Canadian Forces Information Operations Group (CFIOG)) has been coordinating the technical actions necessary to CFNOC is focusing its efforts under the following ongoing lines of operations:

a.

forensics to ensure that malware was not implanted/deployed on networks and workstations that Sub-Lieutenant Delisle had physical access to and that could continue to pose a threat to the integrity of DND/CF Networks.

1/3

A0383247_1-A-2012-01720 - 66

SECRET (LIMDIS)

SECRET (LIMDIS)

DMJLGUf EN VERTU DE LA LM - WNSHGNEMENTS WON CLASSIFY

8. Legal Proceedings. GDI has provided assistance to the Crown Prosecutor through the Release and Disclosure Coordination Office (RDCO) and JAG on initial documents seized by the RCMP. RDCO will maintain liaison with the RCMP and Crown Prosecutor, through the CF National Investigation Service (CFNIS), as the case develops and as more evidence and/or witnesses are identified. 9. It is important to note that the Canadian Military Justice system was not considered in this matter. As noted by the Departmental Security Officer (DSO), the CF's Counter-intelligence efforts, relations with Allies, IT/IM security and overall Defence Security aspects of this case could have been "balanced" with the relative weight of the requirement for a successful prosecution of appropriate charges (e.g. several other options exist under the National Defence Act, as well as all the charges being currently considered). This willbe especially important if the issue "expands" and the need for a more uniform approach and protection of information (which can be more easily accomplished in the Military Justice system) arises. 10. Public Affairs. Since the initial charges laid by the RCMP became public on 16 January 2012, there has been growing regional, national and international media interest in this case. A passive, centralized approach to manage the release of information and media queries has been adopted, with oversight assumed by SJS Public Affairs (SJS PA) from CDS Public Affairs (CDS PA). GDI PA continues to monitor all media reports associated with this case and is liaising directly with SJS PA in the development of media lines in response to and in preparation of ongoing and future requests. Of note, there remains a requirement to develop a GoC-wide strategic communication process between OGDs and central agencies, given the critical need for coordination where media pressure is high and where the absence of an overarching GoC narrative/messaging could impact the security of classified information, national security perceptions and diplomatic relations. ADM(PA) has referred this matter to PCO and in the meantime, is developing an interim communications concept of operations for proper handling of media relations. 11.

2/3

A0383247_2-A-2012-01720 - 67

SECRET (LIMDIS)

SECRET (LIMDIS)

DMJLGll EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFI

12. Access to Information. GDI staff and Director Access to Information (DAIP) have developed a strategy conforming to the Access to Information Act (ATIA) for responding to Delisle-related ATI requests. SIMAT, in its assumption of oversight, is ensuring that all related documentation is being suitably coordinated for archival purposes in support of this requirement. 13. Counter-intelligence (CO Investigation.

14. Damage Assessment. Initial determination of both the extent/volume and sources of potential documents, systems, sites and personnel compromised continues to be ascertained. This process will take time 15. Departmental Security. As sole POC between the RCMP criminal investigation and the CF, CO CFNIS remains engaged with key CF personnel to enable access to files and information systems surveillance. He is otherwise ensuring deconfliction of CF investigative activities with those of the RCMP, facilitating information flow between the two organizations and providing selective subject matter expertise in support of the investigation. CO CFNIS continues to report to the CFPM, VCDS and SIMAT on this investigation. 16. DSO continues to review all aspects of Defence Security that have, or may have contributed to this incident and will undertake immediate implementation action where required. As a consideration within the broader context of CF Transformation, consolidation of all aspects of Defence Security within a single "agency or other suitable organization, with direct links to other national and international security authorities, has been specifically recommended. DSO holds that such an approach would enable cases such as this to be addressed in a more coherent and holistic strategic fashion, thereby enabling fully-informed decisions to be rendered with respect to competing requirements (criminal investigation, Counter-intelligence issues, coordination with OGDs, cooperation with Allies, etc). 17. SIMAT. As previously noted, SIMAT has been established by DOS SJS as the principal strategic staff mechanism through which ongoing departmental coordination, management and adjudication of the aforementioned security issues will be effected. With representation from principal Level 1s, SIMAT will receive situational awareness from all sources, provide analysis and recommendations to senior leadership, coordinate resultant decisions/directives and maintain records of all associated documents, proceedings and other materials. Accordingly, specific, detailed departmental information requirements, such as 360-degree assessments, etc, undertaken forthwith by DOS SJS, will be discharged through SIMAT. RECOMMENDATION 18. Information only; specific recommendations will be coordinated by SIMAT, through DOS SJS.

Annex: Annex A - Security Issue Management Action Team (SIMAT) Matrix, 31 January 2012 Prepared by: Consulted: Resp DG: Resp Group Principal: Date prepared:
3/3

Col D.S. Higgins, Chair, SIMAT, 995-2511 CDI/DGMO; VCDS/CFNIS/DSO/PM; C Naval; SJS Col P.J. Williams, A/DGO SJS, 996-8875 MGen J.H. Vance, DOS SJS 1 February 2012
A0383247J3-A-2012-01720 - 68

SECRET (LIMDIS)

SECRETfLIMDIS) SIMAT MANAGEMENT COORDINATION MATRIX Issue Identified Suspense Date

ULGUE EN VERTU DE LA LAI - RENSEIGNEMEN i& NON CLASSIFIES

SECREmiMDISl

A0383248 1-A-2012-01720 - 69
Jfl
~ 2012-12-0419:31

SIMAT Matrix Master erf 31 Jan 12.xls

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION SECRF.TfLIMDIS) DMJLGUiEN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

SSSEEUMMPIS1

A0383248 2-A-2012-01720 - 70
2/2
~ 2012-12-0419:31

SIMAT Matrix Master eff 31 Jan 12.xls

SECRET DIVUI.GUE EN VERTU OE LA LAI - RENSEIGNEMEN iS NUN OASSIFI SIMAT MANAGEMENT COORDINATION MATRIX Issue Identified Completed

SIMAT Matrix Master elf 31 Jan 12.xls

SECRET

A0383248 3-A-2012-01720-71
' 2012-12-0419:31

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION OIVULGUE EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFY

8.15(1)

<:';,: J '< Organisation.; '^S/icvAV; >>I<srtfsiry'?s; .^ff- . ;v- .t c-:;3.l!-Jan Col Higgins (Chair) LCol Rouleau LCol Humphrey
X DSO

;:;;';7i;

SIMAT Chair Col Lander (DSO) Maj G. Wight

X X X

VCDS CSNI tfc via LCol Legere

Provost Marshall LCol Trudeau (DPM RM) CFNIS LCol Delaney (CO CFNIS)

Maj Cadman

RCN
Capt(N) Plows (COS RCN) ** BGen Williams (DGMS) LCoi Thompson (J1 Coord) LCol Bolt (DLAW I&IO) A. Anishchenko (D Strat A) LCol Theriault (SJS PA) Col Williams (A/DGO) Capt(N) Eldridge (COS) LCol Morris (HQ CO) LCol Demers Maj Pouliot

CDI

TBC

X X X X X

CMP JAG Maj Dow S. Sixsmith LCol Gaudet TBC

ADM(Pol)

ADM (PA)

SJS DGO

CANOSCOM

X X X X

CANSOFCOM

Canada COM Cdr Cope (SMA)

" Capt(N) Hudock after 10 Feb

CEFCOM Maj Lavigne

MNDO

A0383248 4-A-2012-01720 - 72

HELOOCW UIVUCK i nc MIH - uu_Hmtu iwruwwi IUIM DIVULGUE EN VERTU DE LA WI - RENSHGNEMENTS WON CLASSIRES

SECRET BRIEFING NOTE FOR THE CDI SUBJECT: ISSUE Highlight questions and issues raised by briefing on the findings and assessment of the activities of SLT Delisle. BACKGROUND
2. (C

ISSUES AND CONCERNS - ESPIONAGE CASE

1. (C .

General. In early Aug, briefed on the findings of the CDI Damage Assessment

Team.
3. (S

Questions and Concerns.

4.(S

Prior to the case going to trial, As criminal proceedings draw to an end,

5.(S

Opportunities.

Prepared by: Responsible Director: Date prepared:

Mr. J. Kruger, (613) 945-7658 31 Aug 12

SECRET

A0383249 1-A-2012-01720 - 73

DMJLGU EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIR

SECRET// BRIEFING NOTE FOR ASSISTANT SECRETARY TO THE CABINET SECURITY AND INTELLIGENCE - PRIVY COUNCIL OFFICE SUBJECT: POTENTIAL COMPROMISE OF ALLIED DOCUMENTS ISSUE 1. In the course of the ongoing assessment of the potential compromise of sensitive information resulting from the alleged actions of Sub-Lieutenant J.P. Delisle, indicates that classified documents proprietary to were accessed by Delisle through the various means available to him in the course of his duties.

2.
DISCUSSION 3. GDI therefore seeks discretionary authority from PCO, through DOS SJS, to take the following targeted actions:

a.

b.

with a list of their proprietary classified documents known to have been accessed by Delisle and therefore suspected of having been compromised.

CONCLUSION

4.
the fact that Russian agents are suspected of having been Delisle's employers. Prepared by: Reviewed by: Director General: Approved by: Date Prepared: Col D.S. HicjOTS, SJS DACV, 995-2511; Philippe K<5eODM(Pol) D Pol Dev, 995-0096 BGen R.sSvifliams, DGMS, 991-2881 MGen J.M.C. Rousseau, GDI, 945-5120 MGen J.H. Vance, DOS SJS, 992-3355
16 May 12

SECRET// A0383250 1-A-2012-01720 - 74

DIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFY

SECRET // BRIEFING NOTE FOR DOS SJS SUBJECT: POTENTIAL COMPROMISE ISSUE 1. In the course of the ongoing assessment of the potential compromise of sensitive information resulting from the alleged actions of SLt J.P. Delisle, ndicates that classified documents proprietary to were accessed by Delisle through the various means available to him in the course of his duties.

DISCUSSION 2. GDI therefore seeks discretionary authority from PCO, through DOS SJS, to take the following actions:

a.

b.

c.

d.

with a list of their proprietary classified documents known to have been accessed by Delisle and therefore suspected of having been compromised.

CONCLUSION 3. In order for damage to be able to assess properly the

the fact that Russian agents are suspected of having been Delisle's employers.

Prepared by: Reviewed by: Director General: Date Prepared: SECRET//

Col D.S. Higgins, SJS DACV, 995-2511 BGen R.S. Williams, DGMS, 991-2881
19 Apr 12

A0383251 1-A-2012-01720-75

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION 31VULGUEEN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFI *

TOP QCGRgPCANAOlAN EYES ONLY (SECRET LESS ENCLOSURES) BRIEFING NOTE FOR THE GDI SUBJECT: ACCESS TO INFORMATION (ATI) REQUEST A-2011-01566 ISSUE 1. The applicant for this ATI request is seeking "any reports, memos, briefing notes, presentations and security briefings" created or prepared by GDI that discuss the damage caused and any other measures to be put into place following the January 2012 arrest of a naval officer at HMCS Trinity under the Security of Information Act. This is one of several requests the GDI Organization has received on the noted incident, which directly relates to an ongoing investigation. BACKGROUND 2. On 16 January 2012. SLt Jeffrey Paul Delisle was charged under the Security of Information Act with having committed espionage related offences. Since that time there has been significant media / public interest in the case and consequently, an increased number of requests made to the department under the ATI act for information. As this is a particularly sensitive ongoing investigation, any release of information at this time can reasonably be expected to cause injury to current invesliqations. the criminal prosecution and in exoosina DND / CF vulnembiiiti*>; DISCUSSION 3. In instances where there is an ongoing investigation, Section 16 of the ATI Act can be applied to exempt records which fall inlo the scope of an ATI request related to that investigation from release. As the subiect ATI reauest relates to a current investigation,

4. In accordance with this recommendation, the GDI organization conducted a search for relevant records. Records provided were prepared during the course of an onaoinq investigation with some

TOP GCCREf-CANADlAN EYES ONLY ISECRET LESS ENCLOSURES)

1/2
A0383252 1 -A-2012-01720 - 76

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATION DMJLGU EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

8.15(1)

TOP OCGrcCT-CANADIAN EYES ONLY (SECRET LESS ENCLOSURES) RECOMMENDATION 5. It is recommended that GDI sign the enclosed letter lo DAIP indicating that we have conducted a search and are withholding the enclosed information from release under Sections 13(1). 15(1)(i)(iii), 16(1){c) and 22 of the ATI Act. Given the sensitivity surrounding this investiaation and subsenuent documents. DAIP has indicated that Julie Jansen. Director DAIP will come to COI to examine the documents in the event that additional review is required. Prepared by: Responsible Director: Responsible Director General: Jorgen Kruger. DPP Int, Responsible Group Principal: MGen J.M.C. Rousseau, GDI, 945-5120 Date prepared: 13 March 2012

TOP SCCnET-CANADIAN EYES ONLY (SECRET LESS ENCLOSURES) 2/2

A0383252 2-A-2012-01720 - 77