Access to Information on Jeffrey Paul Delisle

7/29/2019 Access to Information on Jeffrey Paul Delisle

1/78

National Defence Defense RationaleNational Defence HeadquartersOttawa, OntarioK1AOK2

Our file: A-2012-01720

SEP 4 2013Mr. Jack JulianCB C Radio NewsP.O. Box 3000 1740 Bell RoadHalifax, No va Scotia B3J 1L2Dear Mr. Julian:This is further to your request submitted under the Access to Information Act for:

Briefing notes and lessons-learned reports held by CD1, SJS, ADM-POL,CDSandCFNIS, related to the case of a named CF mem ber for theperiod Sept. 1, 2011 to Nov. 1, 2012.Enclosed please find all requested records that could be located using the Department's best efforts, within theconstraints of the Act. You w ill note that certain information has been withheld from disclosure pursuant tosections 15(Defence and International Affairs), 19, 21, and 23 o f the Act. Also, please note, that all records heldby CFNCIU (under GDI) have been withheld in full pursuant to section 16 of the Act as they relate to ongoinginvestigations.Please be advised that you are entitled to file a complaint with the Office of the Information Commissionerconcerning the processing of your request within sixty days of the receipt of this notice. In the event you decideto avail yourself of this right, your notice of complaint should be addressed to:

Office of the Information CommissionerTower B, Place de Ville112 Kent Street, 22nd FloorOttawa, OntarioK1A1H3

We also wish to advise you that the Department of National Defence (DND ) complies with the Treasury BoardSecretariat Guid e for Posting Summaries of Completed Access to Information Requests. Summaries of DNDrequests can be found on our w ebsite w ww.forces.gc.ca under the tab "Completed Access to InformationRequests".Should you require clarification or assistance regarding your request, please contact Curtis Mathews of my staffat (613) 995-8410 or by e-mail at curtis.mathews(g>,forces.gc.ca or use our toll free number 1-888-272-8207.Yours truly,

Julie JansenDirectorAccess to Information and PrivacyEnclosure: Release Copy

Canada


2/78

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATIONOWULGUE EN VERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

Strategic Joint StaffDirector

Arms Control VerlfipdTVon

ftat-rnajorInterarmtas strategiqueDi rectaurVerification du contrdledee armements

DOS/MAT REPORTV, " ~1. As directed, the subject report, updated to 28 Sep, is submitted herein.2. Given the volume of associated materials, please note the following:

a. annexes to the report contain only essential elements of key informationand/or account of activity with which SIMAT was directly involved in termsof coordination/overwatch; andb. higher classification or external-sourced documents are accounted for asreferenced materials (released under SEPCOR) under Annex G.

3. As an end-month submission, publication of this report in early October istimely; given the resumption of formal judicial proceedings on 10Oct.4. For consideration.V/R

D.S.ColSJSDACV995-25111 Oct12

ns

SECRET

A0383244 1-A-2012-01720 - 1


3/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONWyULGyjEN VERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIESSECRET S15(1)

National Defence Defense nationaleStrategic Joint Staff Etat-major interarmees strategiqueDirector of Staff Directeur de I'etat-majorNational Defence Headquarters Quartier general de la Defense nationaleOttawa, Ontario Ottawa, (Ontario)K1AO K2 K1AO K2100-1 (SIMAT)

/ October 2012

Distribution List

REPORT -SECURITY ISSUE MANAGEMENT ACTION TEAM (DELISLE CASE)References: A. 2100-1 (SJS DACV) Director of Staff Initiating Directive - Security IssueManagement Action Team (Delisle Case) 27 January 2012B. 2100-1 (SIMAT) VCDS Initiating Directive - Interdisciplinary Task Force onDetectedSecurity Breach - Op ATHENA Info MgtRepatriation 26 March 2012C. SIMAT Report 28 September 2012 (enclosed)1. Since its establishment at Reference A, the Security Issue Management ActionTeam (SIMAT) has served as the Department's principal ad hoc oversight mechanismthrough which overarching coordination and adjudication of any and all matters pertainingto the Sub-Lieutenant J.P. Delisle case, together with other security-related issues, havebeen undertaken on a continuous basis.2. Under its assigned terms of reference, SIMAT has provided situationalawareness from all sources, while coordinating and otherwise facilitating the formulation,development and promulgation of detailed guidance and specific courses ofimplementation within the Department and Canadian Forces. It has also served to assistand support, where appropriate, inter-departmental and other external efforts pertainingto security-related matters. In all respects, SIMAT has served as an interim body only,pending the establishment of new or modified mechanisms as part of an evolveddepartmental security issue management apparatus.3. By design, SIMAT methodologies have been rudimentary in nature, entailing theinitial identification of a given security issue, from which a process of analysis,evaluation, coordination, recommended action implementation, monitoring and ollow-upassessment can be undertaken. In this respect, SIMAT has not been assigned specificoversight; rather, it has served as a channel through which to enable applicable OPIs tomore effectively discharge existing responsibilities or assume new functions, asdetermined by higher authority. Indeed, given the highly complex and technical natureof several attendant security matters, the establishment of tangential staff mechanismshas been required in some instances. Such was the case with the stand up of theadjunct Interdisciplinary Task Force on Detected Security Breach (Operation ATHENA),which has undertaken specific, concerted actions to localize, contain and mitigate theeffects of a security incident pertaining to that operation.4. Overall, SIMAT and corresponding matrixed activities have proven reasonablyeffective as an overall provisional approach to detecting and identifying security issuesand subsequently providing the characterization, analysis and assessment required to1/2CanadaSECRET A0383244 2-A-2012-01720-2


4/78

SECRETRELEASED UNDER THE AM - UNCLASSIFIED INFORMATIONDIVULGUE EN VERTU DELALAI - RENSBGNEMFJUTS NON OASSIFIE1

enable senior-level decision making, coordinated action, monitoring, tracking andrecords management. Nevertheless, SIMAT's mandate will effectively lapse with theresumption of formal judicial proceedings against Sub-Lieutenant Deiisle, along with theprogression of the Departmental Security Tran sform ation Initiative. This initiative,established by VCDS , will improve security functions within National Defe nce throughthe development of a viable and sustainable Departmental Security Plan, pursuant to thePolicy on Governm ent Security and consistent with the Government's SafeguardingInitiatives Task Force. Accordingly, given the Departmental Security Officer's current co-chairmanship, SIMAT functions will be effectively assum ed by the Senior SecurityAdvisory Committee, concurrent with that body's increased executive oversight within anevolved Defence Security Programme.5. The enclosed report, which provides a synopsis of SIMAT-administered securityissues, coordinated staff actions and associated outcomes, is enclosed. Please addressany queries on individual issues contained within the report to the corresponding OPI orthe SI MAT Co-Chairs:

a. Colonel R.M. Lander, Departmental Security Officer, 613-943-7542,Rod. Lander forces.qc.ca: and

b. Colonel D.S. Higgins, Director Arms Control Verification, 613-995-2511,David.Hiqqinsforces.qc.ca.

Major-GeneralEnclosure: 1Distribution ListActionSJS J3Comd Canada COMComd CEFCOMComd CANSOFCOMComd CANOSCOMC NavalC ArmyC Air ForceADM(IM)ADM(IE)ADM(Pol)ADM(PA)CDIJA GCMPADM(HR-Civ)2/2SECRET

InformationCDSDMVCDSMNDOADM(Fin CS)ADM(S&T)DND/CF LACR SDComd NORADCANMILREP NATOCANMILREP PRMNYComd CDLS(W)Comd CDLS(L)SIMAT

A0383244 3-A-2012-01720 - 3


5/78

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATIONDIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NONCLASSIFIES

SECRET,

DEPARTMENT OF NATIONAL DEFENCEStrategic Joint Staff

Security Issue Management Action TeamREPORT- SUB-LIEUTENANT J.P. DELISLE CASE

28 September 2012

SECRET,A0383244 4-A-2012-01720 - 4


6/78

RELEASED UNDER THE AM - UNCLASSIFIED INFORMATION

DMJLGU EN VERTU DELALAI - RENSBGNEMENTS NON OASSIFII

SECRET/ s-15

FOREWORD

Particulars associated with the investigation and subsequent prosecution ofSub-Lieutenant J.P. Delisle under the Security of Information Act and Criminal Code of Canada,following allegations of having communicated information to a foreign entity without lawfulauthority, have resulted in extensive efforts to contain, resolve or otherwise mitigate extant andpotential vulnerabilities within the security and intelligence apparatus of the Department ofNational Defence.Concurrent with the transfer of departmental oversight of the Delisle case from the Chief ofDefence Intelligence, the Security Issue Management Action Team (SIMAT) was established bythe Director of Staff, Strategic Joint Staff, as the principal body through which specificconcomitant responsibilities would be discharged on his behalf.

Accordingly, SIMAT has served as the principal provisional staff mechanism through whichdepartmental coordination, facilitation and management of issues associated with the Delislecase, along with other specific security matters warranting similar strategic-level adjudication,have been addressed, pending the transition to an ameliorated security issue managementcycle. With representation from principal Level 1s, SIMAT has promulgated strategicawareness from all sources, provided analysis and recommendations to senior decision-makers, coordinated resultant decisions/directives and maintained records of associateddocuments, proceedings and other materials.The enclosed report provides an overview of SIMAT-administered security issues andcoordinated staff actions, outcomes and current status during the period 27 January to28 September 2011. Detailed accounting of individual issues and actions undertaken has beenduly provided in corresponding reports, returns and other documentation attributable to theapplicable Offices of Primary Interest, within their corresponding jurisdictions.

D.S. Higgifis R.M. LanderColonel ColonelCo-Chair Co-Chair

Security Issue Management Action Team (SIMAT)

SECRETA0383244 5-A-2012-01720 - 5


7/78

RELEASED UNDER THE AIA - UNCLASSIREDINFORMATIONDIVULGUE ENVERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

SECRET

TABLE OFCONTENTS

SECTION ONE-INTRODUCTION 1BACKGROUND 1AIM 1SCOPE 1

SECTION TWO - ANALYSIS AND ASSESSEMENT 2DAMAGE ASSESSMENT 2OPERATIONS 3

Synopsis 3Evaluation/Analysis 3Determinations 4Action Implementation 4Lessons Learned 5Business Continuity Planning (BCP) 5

FORCE PROTECTION 5General 5Reaction within GOC 6Security and Counter-intelligence Investigations 6Poor Security Practices 7

'Summary 7INTELLIGENCE 7INFORMATION MANAGEMENT 8

Synopsis 8Evaluation/Analysis 8Determinations 9Action Implementation 9Lessons Learned 9

DEPARTMENTAL SECURITY 10Security Clearance-Related Shortfalls 10

INVESTIGATION 11

SECRET

A0383244 6-A-2012-01720 - 6


8/78

RELEASED UNDER THEAIA - UNCLASSIFIED INFORMATION

DIVULGE ENVERTU DE LA LAI RENSHGNEMENTS NON CLASSIFIES

s.19(1)

LEGAL PROCEEDINGS 11Synopsis 11Option to Transfer to the Military Justice System 11Current Situation 12

POLICY 12Parliamentary Queries 12

12PUBLIC AFFAIRS/COMMUNICATIONS 13

Public Affairs Concept of Operations 13Public Affairs Approach 14Public Affairs Coordination 14Media Synopsis 14

PERSONNEL 15Welfare of and Support to Sub-Lieutenant Delisle 15Synopsis of Personnel Support to Sub-Lieutenant Delisle and Dependants 15Status of Dependants 16Divisional System 17

1718

Evaluation/Analysis 19Determinations 19Action Implementation 19

SECTION THREE - CONCLUDING MATERIAL 20SIMAT CO-CHAIR DEDUCTIONS AND DETERMINATIONS 20ANNEXES:............. .......21

inSECRET//CAN/USA LIMDIS

A0383244 7-A-2012-01720 - 7


9/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONWyULGylENVERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

SECRET;

REPORTSECTION ONE - INTRODUCTIONBACKGROUND1. (U) In January 2012, Sub-Lieutenant Jeffery Paul Delisle was arrested and charged under theSecurity of Information Act and Criminal Code of Canada for having allegedly communicatedinformation deemed harmful to the national interest to a foreign entity between July 2007andJanuary 2012. In 2010, Sub-Lieutenant Delisle was assigned at both the Chief of DefenceIntelligence and the Strategic Joint Staff. His last posting was HMCS TRINITY, Halifax, where hehad access to intelligence related to Canadian Forces plans and operations, in addition tointelligence and other information concerning Allies and countries of interest to Canada.AIM2. (S, This report provides an overview of activities undertaken through heSecurity Issue Management Action Team (SIMAT), as directed by the Director of Staff StrategicJoint Staff (DOS SJS), following the discovery of alleged espionage activity by Sub-LieutenantDelisle and ensuing determinations concerning deficiencies in departmental security. Generallyspeaking, SIMAT activities have constituted a provisional approach to the oversight andmanagement of subsequent efforts to detect, contain, resolve or otherwise mitigate the deleteriouseffects of this alleged activity, along with related systemic faults, within the Department ofNationalDefence, other Government departments, Allies and individuals.SCOPE3. (S/ As directed by DOS SJS, SI MAT'S efforts have focussed upon any andall matters pertaining to departmental security management attributable to or resulting from theaforementioned security breach, employing a process of issue identification, management,analysis, evaluation, action, implementation/coordination and monitoring/review. This reporttherefore provides an account of the issues identified and analyzed by SIMAT and itsconstituents,with a view to detecting and characterizing specific concerns, coordinating action to isolateassociated impairment and determining and recommending courses of action to address anyidentified associated security faults. The report also provides some insight concerning themannerin which the CF has engaged Sub-Lieutenant Delisle's family as affected individuals, along withbroader considerations pertaining to measures required to re-establish/reinforce the fundamentalintegrities of the Defence Security Programme.

REPORT-1/21 SECRETA0383244 8-A-2012-01720 - 8


10/78

RELEASED UNDER TtHE AIA - UNCLASSIFIED INFORMATIONDIVULGU EN VERTU DELA LAI - RENSEIGNEMENTS NON CLASSIFII

SECRET) S'15(1)

SECTION TWO - ANALYSIS AND ASSESSEMENTDAMAGE ASSESSMENT1. (C. A Damage Assessment Team (DAT) was assembled by the Chief of DefenceIntelligence (GDI) following the arrest on 13 Jan 2012 of Sub-Lieutenant J.P. Delisle on suspicionof unlawfully passing classified information to agents of a foreign entity; namely, the RussianFederation.2. (Si The GDI DAT was formed under BGen R.S. Williams on 1 Feb 2012. Itsmandate was to gather, collate and analyze all available data connected to Delisle's access tosensitive information, and present its findings to GDI.

3. (S,

4. (S

5. (S

6. (S,

REPORT - 2/21 SECRET; A0383244 9-A-2012-01720 - 9


11/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONPIVULGUE ENVERTU DE LALAI - RENSFJRNEMENTS NON CLASSIFIED

SECRET

OPERATIONSSynopsis1. (S/

2. (Si

3. (S

4. (S/ GDI conducted its investigations and initial damage assessment nconcert with OGD agencies, in particular the Communications Security Establishment Canada(CSEC) and Canadian Security Intelligence Service (CSIS),

5. (S/

Evaluation/Analysis6. (S,

REPORT -3/21SECRET

A0383244 10-A-2012-01720 - 10


12/78

RELEASED UNDER THE AM - UNCLASSIRED INFORMATIONDIVULGU EN VERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

SECRET)

7. (S

a.

b.

Determinations8. (S,

Action Implementation9. (S/ the RCN undertooka pan-i\avy investigation to ensure that existing BCPs were updated and verified that existing UnitSecurity Orders were current and drafted IAW existing security policies. Once verified, refreshertraining for all pers in MARPAC and MARLANT was initiated.10. (S,

a.

REPORT - 4/21 SECRET A0383244 11-A-2012-01720 -1 1


13/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGE EN VERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

SECRET

Lessons Learned11. (S;

12. (S,

Business Continuity Planning (BCP)13. (S. BCP within the Government of Canada generally falls under theresponsibility of the DSO and is reported on in the Management Accountability Framework (MAF)as such. BCP within DND is the responsibility of commanders at all levels and is overseen at thenational level by the SJS. BCP is neither normally tied into the Business Planning Process, nor isit routinely exercised or assessed. After the discovery of Delisle's activities,was conducted partly IAW the applicable BCPand partly as an ad hoc reaction to the requirement. The security transformation ManagementAction Plan (MAP) will include options to incorporateBCP (perhaps renamed operational resilienceplanning for CF purposes) into the proposed centralized security authority. This would allow aseamless process to occur when a security inspection or audit discovers security issues that areserious enough to suspend the clearance of a system, facility or unit, so that the BCP must beactivated and this process can also be assessed and reported upon in a comprehensive fashion.FORCE PROTECTIONGeneral14. (S On reviewing the circumstance surrounding the Delisle case, CanadaCOM determined there was need to re-evaluate the CF force protection posture within thedomestic AOR. The HQ staff conducted a brief appreciation in conjunction with the SIMAT. Theassessment determined that, while a general increase in force protection posture was not required,there was a need to increase situational awareness with respect to security threats within the AORand/or implement select information security force protection measures. Rather, a force protectiontasking order was drafted, in consultation with SIMAT, to achieve these aims. The order wasissued by Canada COM at COMD 002/12 DTG 081952Z MAR 12.REPORT - 5/21

SECRETA0383244 12-A-2012-01720 -12


14/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGUg EN VERTU DE LALAI - RENSH6NEMENTS NON CLASSIFY

8.15(1)SECRET

15. (G The Canada CO M force protection tasking order instructedCFelements within the domestic AOR to implement the following force protection measures (FPM):

a.

b.c.

d.

16. (G All addressees to the order acknowledged receipt and undertookimplementation. Canada COM HQ continues to respond to questions from outstations and isproviding ongoing coordination and guidance. Canada COM HQ will continue monitor theimplementation of additional FPM.Reaction within the Government of Canada17. (S, When Delisle's activities were discovered, the criminal investigationwas undertaken by the RCMP, with associated security intelligence activities undertaken by CSIS.Eventually, charges were laid and are now being pursued in civilian court. Little or no discussionconcerning the advantages of employing the Military Police to lead the criminal investigation, theCFNCIU to lead the counter-intelligence investigation and laying the charges under the MilitaryJustice System (MJS) appears to have occurred and/or fully informed decisions made WRTtheway ahead. An incident such as this should be viewed as primarily a security issue and thedecision to arrest, lay charges or otherwise indicate to the FolS (Foreign Intelligence Services)involved that Canadian authorities are aware of the individual and his activities should beundertaken in a fully-coordinated and well-informed manner. Whenever a member of the CF issuspected of involvement in such activities, the default practice should be to inform DNDimmediately and an early decision made at the appropriate level within the Government of Canadaas to how the matter should be approached. There may be cases where non-DND entities shouldassume the lead, but the advantages of using intrinsic assets to investigate and possibly exploitindividuals involved, as well as pursuing any charges in the MJS dictate that this should be thenorm, with RCMP and CSIS assistance utilized on an "as required" basis. All senior Governmentauthorities involved in security and intelligence matters should be made aware of the alternativesavailable to pursue suspects subject to the Code of Service discipline, so that automatic defaults tomechanisms more applicable to civilians do not occur. The security transformation MAP willenvision a sufficiently resourced DND DSO, organizationally situated at a sufficiently high level andwith responsibility for effective liaison with PCO, CSIS etc. This should ensure appropriateawareness and informed decision making before any process is embarked upon, as well as thecapacity to coordinate effective responses to such incidents in the future.Security and Counter-intelligence Investigations18. (S, DND has a counter-intelligence capability in the CFNCIU,

Low-level or initial security investigations are normally conductedby thelocal Military Police, augmented by Summary Investigations or BOIs, where requiredby policy.REPORT - 6/21 SECRET,

A0383244 13-A-2012-01720 - 13


15/78

RELEASED UNDERTOE HA - UNCLASSIFIED INFORMATIONDIVULGUS EN VERTU DE LA LAI - RENSHGNRMBMTS NOW CLASSIC

SECRET

Good security practicesharden facilities, systems and organizations against attack and compromise, and when used in aninterlocking fashion with other measures, greatly reduce the possibility of successful espionage.

The security transformation MAP will incorporate an audit and inspection regime,as well as a reinvigorated training, education and awareness programme that will improve securitypractices across DND.20. (Si The Delisle case reveals several deficiencies in the extant DefenceSecurity Programme. Many of these have also been identified in CRS and OAG audits, as wellasthrough the MAP. A proposal by the Departmental Security Officer (DSO) has been agreed to, inprinciple, by VCDS and subsequently briefed to DSX. This proposal plans to address thesedeficiencies, starting with approval to create a comprehensive MAP and work plan that will includedetailed analysis, a proposed CONOPS and draft MIP for presentation at Defence ManagementCommittee (DMC) as soon as practicable, designed to consolidate the many disparate securityprocesses and functions in one appropriately positioned and resourced security authority.Summary21. (S The Departmental Security Programme is andin need of transformation. DND is one of the most targeted departments within the Government ofCanada. Whether the threats are technological, human or physical, vulnerabilities must beassessed within a comprehensive, integrated and efficient approach to enterprise security riskmanagement. The security transformation MAP and associated mechanisms is a logical process toaddress the security related concerns and allow for informed decision making WRT riskacceptance. It should be approved, finalised and implemented as soon as possible.INTELLIGENCE22. (U) Details have been promulgated at Annex G (released under SEPCOR).REPORT - 7/21 SECRET,

A0383244 14-A-2012-01720 -14


16/78

RELEASED UNDER THE AIA - UNCLASSIFIED NFORMATION3IVULGUE ENVERTU DE LA LAI - RENSBGNEMENTS NON CLASSIFIES

SECRET) s.15(1)

INFORMATIONMANAGEMENTSynopsis

28. (U) Annexes B and C provide details of actions, outcomes and issues relevant to the CyberDefence Incident Response Process for this operation.Evaluation/Analysis

REPORT -8/21 SECRET/A0383244_15-A-2012-01720 - 15


17/78

RELEASED UNDER THE A - UNCLASSIRED INFORMATIONDIVULGUE' EN VERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

SECRET, S '15(1)

Determinations30. (S, Following the IMCAT held 20 Jan 12, it was determined that theincident triggered CCIR 2 (Challenges to Sovereignty) and CCIR 6 (events involving DND/CF withpotential to generate significant public or international interest).Action Implementation31. (S Following the Sub-Lieutenant Delisle incident, the need to have anoverall security management and event capability became apparent. Implementation of theSecurity Information and Event Management (SIEM) system was already ongoing, which wouldprovide that type of capability; however, since the initial intention was to implement SIEM followinga low-high approach, priority of work was re-aligned and CLAS domain became the priority versusDES, even though all activities are being undertaken in parallel mode in order not to losemomentum. Latest classified activity is under RFC 72349.Lessons Learned32. (Cl The following findings are derived from the CFNOC Cyber DefenceOperations review of activities and outcomes during Op DIAMOND. These findings have beendocumented in an effort to provide lessons observed and generate further discussion to developaction items in an effort to enhance response time and increase cyber defence competencieswhen responding to future high-level incidents of this nature.33. (S/ Findings. Identified CFNOC internal gaps/recommendations include:

a. an accurate list of all Network Operational Authority staff who need to be contactedwhen a decision is required needs to be established and maintained for operationaleffectiveness and accountability;b. a complete breakdown of external agencies respondent to CFNOC would facilitatethe tasking process (i.e. DIMEI, DIMCA, DIMTPS, 76 Comm Gp);c. external tasking instructions should be as detailed as possible to ensure variousSystem Administrators maintaining network logs for their specific network enclavesprovide concise returns (DTG, Location, and Systems) and to avoid confusion;d. CFNOC has an enterprise mandate to protect all DND/CF networks andwouldbenefit from acquiring all pertinent network topology and schematics to enhance SA

and Cyber/Network Defence posture; ande. the currentrelevant information to maintain SA externally and internally to CFNOC on currentCyber Defence Operations, as required, during high level operations.

34. (S; Findings. Identified external gaps/recommendations include:a. a lack of response to CFNOC requests for feedback to be included in the AAR from

external stakeholder units;

REPORT -9/21 SECRET,A0383244 16-A-2012-01720 -1 6


18/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGUE EN VERTU DE LA LAI - RENSHGNEMENTS NON CLASSIFIE

5.1-5(1)SECRET,

b. external agencies require a general understanding of the current cyber defencemission to ensure compliance and SA is maintained:(1) the establishment of daily or weekly Battle Update Briefs (BUB) with

stakeholders is recommended to ensure fluid passage of information,understanding of priorities and compliance; and

(2) identification of critical cyber defence stakeholders regardingc.

d. development of operational orders that delineate key factors in ensuring missionrequirements to be met, to include:

(1) a comprehensive communications plan establishing contact points, types ofdeliverables and higher level directives for adherence by all stakeholders;(2) OPSEC guidelines to capture the Commander's intent and regulationsgoverning the handling of the mission; and(3) detailed groupings and tasking to avoid duplication of effort and to ensurestakeholders complete their assigned mission segments in accordance with

commanders' requirements;e. andf. implementation of an emergency RFC approval process for the deployment of cyberdefence tools on any network segment, to ensure timely response on any DND/CF

enclave.35. (U) The intent is that this AAR form part of follow-on discussions and processes to closeidentified gaps, with a focus on upgrading and reinforcing the cyber defence capabilities on all CFnetworks, in support of CF missions. While the aforementionedprovides recent status update, additional information may follow as required.DEPARTMENTAL SECURITY

REPORT-10/21SECRET

A0383244 17-A-2012-01720 -17


19/78

SECRET

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGUg EN VERTU DE LALAI - RENSETCMEM :r-TS H'ON CLASSIFIES

s.23

INVESTIGATION36. (U) Details provided at Annex G (released under SEPCOR).LEGAL PROCEEDINGSSynopsis37. (U) Following investigation by the RCMP and CSIS, Sub-Lieutenant Delisle was taken intocustody by the RCMP on 14 January 2012. He was charged with one count of Breach of Trust,pursuant to s.122 of the Criminal Code of Canada and two counts of Communicating SafeguardedInformation to a Foreign Entity without Lawful Authority, pursuant to s.16(1) of the Security ofInformation Act. The former charge carries a maximum sentence of five years imprisonment,whereas the latter charge carries a maximum sentence of imprisonment for life.38. (U) Sub-Lieutenant Delisle appeared initially before the Provincial Court of Nova Scotia on17 January 2012 in order to determine bail, where his counsel at the time requested a delay inorder to have more time to prepare. Following several more delays, Sub-Lieutenant Delislewaseventually denied his application for bail on 30 March 2012, and a publication ban on evidencepresented as part of this application was granted.39. (U) On 8 May 2012, Sub-Lieutenant Delisle's counsel again appeared before the ProvincialCourt of Nova Scotia and requested an adjournment. This request was made in order to permitthe Crown more time to review and release relevant documents. The request was granted, andthe case was adjourned until 13 June 2012. Subsequent determinations have since resulted inadditional adjournment and Sub-Lieutenant Delisle's election to be tried by a Nova Scotia SupremeCourt judge and jury. An administrative court appearance was expected on 21 September, but didnot occur. Accordingly, a three-day hearing, to commence on 10 October remains scheduled.

40. (C/ Solicitor-Client Privilege -

41. (C/ Solicitor-Client Privilege

REPORT- 11/21SECRET

A0383244 18-A-2012-01720 -1 8


20/78

RELEASED UNDER THE AIA - UNCLASSIRED INFORMATIONDIVULGUS EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIRE5

= 'Jl >fSECRET; 5.21(i>(a)s.23

Current Situation42 . (C/ Solicitor-Client Privilege -

43. (C/ Solicitor-Client Privilege -

POLICYParliamentary Queries44. (U)There has been minimal Parliamentary activity with regard to the Delisle case. Indeed,there has been just one question asked in the House on the matter. On 10 Feb 2012, ND P MPDon Davies asked about apparent contradictions between media reports he said were fed by"Conservative sources" that four Russian diplomats were expelled over the Delisle case andRussian denials that this was indeed the case. He asked whether the story wa s meant to distractattention from "this massive security failure," which he also referred to as the "biggest intelligencebreach in recent Canadian history." Deepak Obhrai, Parliamentary Secretary for to the Minister ofForeign Affairs, refused to comment on the grounds that the matter related to national security.45. (C From 22-28 August, the generation of Advice to the Minister, subject"Misconduct," was coordinated by D Parl A amongst VCDS, SJS, CMP,ADM(PA) and SIMATstaffs. This document included reference to charges against Sub-Lieutenant Delisle. Specifically,advice stated that should the Minister be asked about the Delisle case, he should respond that thatthe CF take the security of sensitive information very seriously; that CF personnel handlingsensitive information observe stringent procedures and are held to a high ethical standard; thatSub-Lieutenant Delisle has been charged with offenses under the Criminal Code and the Securityof Information Act following a comprehensive investigation by the RCMP, assisted by the CF; andthat he cannot comment further, since the investigation is ongoing and the matter is before thecourts. Media background included with this document included an update on items pertaining tothe Delisle case.Relations with the Russian Federation46. (S/

REPORT-12/21SECRET/

A0383244 19-A-2012-01720 - 19


21/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGUE EN VERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

SECRET'

48. (C, In the meantime,

In September 2011, the Chief of Defence Staffand National Security Advisor visited their Russian counterparts in Moscow. This was followedbya November 2011 Russian delegation visit to NDHQ, where discussions between the Chief,Military Personnel and Russian counterparts took place on a range of issues, includingrecruitment, training and education, and compensation and benefits. Another Russian delegationvisited Canada Command in February 2012 to acquire Canadian Forces lessons learned romsecurity operations undertaken in support of the 2010 Vancouver Olympic (Operation PODIUM),as well as the G-8/G-20 Summits (Operation CADENCE).49. (C, Russia participated in the Northern Chiefs of Defence meeting hostedby CDS in Goose Bay NL, 12-13 April. The meeting was intended to build upon existing defencerelationships in the region and to strengthen operational links, as identified in the CDS/DMDirective on the North. The meeting also supported Canada's Arctic Foreign Policy, which seeksto advance the Government's Northern Strategy by enhancing bilateral and multilateralcooperation with other Arctic countries. General Makarov, Chief of the Russian General Staff,attended, along with a delegation of six high ranking military representatives.50. (U) The most recent high-level DND/CF interaction with Russia was the attendance of the then-Deputy Commander of the Royal Canadian Air Force at an Open Skies conference and air show inMoscow in August 2012. The event, attended by over 75 countries, was to mark the hundred-yearanniversary of the Russian air force. The conferencewas to discuss military-technicalcooperation, training of air personnel, organization and use of airspace, and flight safety, amongother topics.

PUBLIC AFFAIRS/COMMUNICATIONSPublic Affairs Concept of Operations52. (U) An initial Public Affairs (PA) Concept of operations (CONOP) has been implemented tocoordinate responses to media queries, and the release of information to the public related to theDelisle case.REPORT-13/21

SECRET A0383244 20-A-2012-01720 - 20


22/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIOND1VULGUE EN VERTU DE LA LAI-RENSHGNEMENTSNON CLASSIFIESs.15(1)

SECRET

Public Affairs Approach53. (S The initial and current PA approach for the release of informationregarding this issue is PASSIVE.Public Affairs Coordination54. (C Given the serious nature of the charges and the perceived implicationsfor national security and diplomatic relations, the need for careful, close coordination has beenrecognized in ensuring that messaging is in alignment with a central Government of Canadanarrative. However,responses to media queries have been coordinated on a case-by-case basis.Media Synopsis55. (U) Initial media interest on this file has been extensive and international in scope. Coveragehas since been intermittent, and directly tied to the frequency of court appearances. A publicationban has been put into effect limiting domestic covera ge, but leaving the door open for internationalreporters in attendance at court appearances.56. (C. Queries:

a. 28 queries were responded to between 16 and 25 January - prior to the stand-up ofSIMAT and adoption of the PA CONOP;b. seven media queries were responded to between 26 January and 30 April;c. five media queries were responded to between 1 May and 1 September; andd. delays of up to four days were encountered when processing query responses.

57. (C Reporters: Teams of reporters have been assigned to this case(summarized below) and have conducted research/interviews which may appear in future articlescoinciding with court milestones.58. (U) Broadcasts:

a. CBC -b. RDI -c. CTV-d. GLOBAL-:

59. (U) Print:a. HALIFAX CHRONICLE HERALD -b. TORONTO STAR -c. NATIONAL POST -

REPORT-14/21 SECRET A0383244 21-A-2012-01720-21


23/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDMJLGU EN VERTU DE LA LV - WfcHGNEMENTS NON CLASSIFY

SECRET S '19(1)s.23d. MACLEANS -

60. (U) Wire Service:a. CANADIAN PRESS -b. POST MEDIA -

v61. (U) International:a. NEW YORK TIMES-b. WALL STREET JOURNAL -C. TELEGRAPH -d. THE AUSTRALIAN -6. AUSTRALIAN ASSOCIATED PRESS -

PERSONNELWelfare of and Support to Sub-Lieutenant Delisle62. (C Evaluation. To date, there has been no direct contact support to Sub-Lieutenant Delisle; however, he is aware that Lieutenant (Navy) Dobson is the Assisting Officer.This current arrangement will likely change upon administrative review, which is currently on hold,pending further trial developments. With respect to administration, the Assisting Officer conveysinformation through Sub-Lieutenant Delisle's lawyer, Mr Mike Taylor. There has been oneadministrative matter regarding pay for which TRINITY coordinated information from Sub-Lieutenant Delisle regarding new banking information,

63. (Si Determinations. TRINITY has determinedthat until it becomes absolutely necessary, all communications with Sub-Lieutenant Delisle are tobe conveyed through his lawyer.64. (C, Action Implementation. There has been no direct contact. Alladministrative support provided by TRINITY has been through Sub-Lieutenant Delisle's lawyer,

65. (C. Lessons Learned. Handling of all associated administrativepaperwork should be effected through the Member's lawyer, in order to maintain full impartiality.Synopsis of Personnel Support to Sub-Lieutenant Delisle's Dependants66. (C Sub-Lieutenant Delisle was taken into custody by the RCMP on14 Jan 12. HMCS TRINITY CoC immediately undertook actions to contact the family membersREPORT-15/21 SECRET, A0383244 22-A-2012-01720 - 22


24/78

SECRET)

and offer assistance.

Status of Dependants

REPORT-16/21SECRET

RELEASED UNDER THE AIA -UNOASSIRED INFORMATIONDIVULGUfENVERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

A0383244 23-A-2012-01720 - 23


25/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGU^ EN VERTU DE LA LAI - RENSOGNEMENTS NON CLASSIFIES

SECRET S.19(1)

74. (U) Determinations. It is highly important to establish support, utilizing all available resources,as early as practical and maintain open lines of communications.75. (U) Action Implementation. From the moment contact was established with family members,HMCS TRINITY'S Executive Officer and Assisting Officer have assisted all concerning as best aspossible, seeking and relaying information, by telephone and email with relatives.76. (C Lessons Learned. A flexible, adaptive approach to established SOPsin establishing contact, assisting and facilitating contact between the family and key agenciesPOCs enabled TRINITY to effectively satisfy the family's concerns in an expedient andprofessional manner.

REPORT-17/21 SECRET, A0383244 24-A-2012-01720 - 24


26/78

RELEASED UNDER THE AIA - UNCLASSIRED INFORMATIONDIVULGUE EN VERTU DELALAI - RENSBGNEMENTS NON CLASSIFY

SECRET S.19(1)

80. (C// Lessons Learned. Acknowledge requests, but prior to respondingalways ensure verification of the matter with appropriate Orderly Room staff and/or other SME andAJAG, prior to furnishing a response. In all cases, when knowledge regarding a specific queryresides at the Formation Orderly Room, a designated SME should directly provide the response to

81. (C, Since Sub-Lieutenant Delisle was arrested by the RCMP in January,TRINITY has provided extensive support to his family (in particular,TRINITY'S Executive Officer has

informed Sub-Lieutenant Delisle's In all instances,TRINITY ensured SME at the Formation Orderly Room and AJAG were consulted prior toproviding responses to requests. In anticipation of the upcoming trial, TRINITY intends to retainLieutenant (Navy) Dobson as Attending/Assisting Officer, pending a change in administrativerequirements.

REPORT-18/21SECRET A0383244 25-A-2012-01720 - 25


27/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION

DMILGUE EN VERTU DE LALAI - RENSEIGNEMENTS NON OASSIFI'

SECRET/,

REPORT-19/21 SECRET;A0383244_26-A-2012-01720 - 26


28/78

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATIONDWULGUE EN VERTU DE LA LAI - RENSBGNEMENTS NON CLASSIFIES

SECRET; s '15(1)

SECTION THREE - CONCLUDING MATERIALSIMAT CO-CHAIR DEDUCTIONS AND DETERMINATIONS1. (S/, Assessments pertaining to specific issues are contained withinrespective sections, as submitted by the corresponding Offices of Primary Interest, with additionalSIMAT comment provided where warranted. Otherwise, from an orientation andproceduralperspective, activity undertaken by SIMAT representatives, which includes departmental securitySMEs, has aptly illustrated that, while the circumstances pertaining to the Delisle case are uniqueunto themselves, the following overarching deductions and determinations are nevertheless highlyrelevant:

a.

b.

c.

d.

e.

f.

h.

REPORT - 20/21 SECRET;A0383244 27-A-2012-01720 - 27


29/78

ANNEXES:Annex A -

Annex B-

Annex C -

Annex D-Annex E-Annex F-

Annex G -

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATIONDIVULGUE EN VERTU DELALAI - RENSHGNEMENTS NON CLASSIFIES

SECRET,

(SECRET//LIMDIS) Director of Staff Initiating Directive -Security Issue Management Action Team (Delisle Case)(SECRET, CFNOC Operation Diamond Final SITREP -162200Z - 212200Z FEB 2012 (less appendices)(SECRET.Operation Diamond (less annexes)

CFIOG After-Action Report

(UNCLAS) Advice for the Minister - Misconduct(UNCLAS) ADM(PA) Media Monitoring and Analysis - Security Summaries(SECRET, DSO Security Transformation ManagementAction Plan (Abbreviated)(SECRET List of Primary Referenced Documents(Released Under Separate Correspondence)

REPORT-21/21SECRET

A0383244 28-A-2012-01720 - 28


30/78

RELEASED UNDER THE AIA - UNOASSIRED INFORMATION

Anpex A ,2100-1 (SIM AT) SIMAT REPO RT28Sep12

. HSECRET fLIMDISINational Defence Defense nationalsSiratejic Join: Sta" Etat^majc' interarrr.ees stratftjique ,Dirscto-of Staff Direaeurdereiat-fnaior jNationa; Defence Headquarters Quarter genera: ae la Defense natona'eOttavrB. Ontario Ottawa. (Ontario)K1AC-K2 K1AOK2100-1 (SJSDACV)

January 2012Distribution ListDIRECTOR OF STAFF INITIATING DIRECTIVE -SECURITY ISSUE MANAGEMENT ACTION TEAM (DELISLE CASE>References: A. National Defence Security Policy, 4 January 2012B. CDS Weekly Operations Briefing, 24 January 2012GENERAL1. Further to Reference B, circumstances concerning recent security-relatedallegations against Sub-Lieutenant J.P. Delisle have necessitated the establishment of astanding staff mechanism through which to provide ongoing coordination, managementand adjudication of the Department's oversight of associated issues. Accordingly, I planto establish a Security Issue Management Action Team (SIMAT).AIM2. SIMAT will serve as the principal conduit for the provision of srtuationalawareness from all sources and response coordination. It will also recommend directionand guidance to senior leadership on a regular recurring basis, in order to assureeffective strategic oversight and harmonization of effort pertaining to these issues.SCOPE3. SIMAT will address any and all matters pertaining to departmental security issuemanagement attributable to or resulting from the associated security breach, following ageneral process of issue identification, management analysis, evaluation, actionimplementation/coordination and monitoring/review. It will achieve this in the followingmanner:

a. capture all relevant issues, as identified by representatives or otherwisesubmitted;

b. provide characterization, analysis and assessment, along withdeterminationof priority, OPI/OCL actions taken and current status;c. track and review ongoing issues and provide updated recommendations odepartmental senior leadership through DOS SJS;

1/3A-1/5 V^dUdXla SECRET (LIMDIS)SECRET (LIMDIS) A0383244 29-A-2012-01720 -29


31/78

A-2/5

SECRET (LIMDIS)RELEASED UNDER THE AM - UNCLASSIFIED INFORMATIONOIVULGUE EN VERTU DELALAI - RENSBGNEMENT5 NONCLASSIFIES

5 . 15 ( 1 )

SECRET (LIMDIS)d. receive departmental senior leadership direction through DOS SJS and

promulgate accordingly; ande. maintain records of all proceedings and staff actions for archival purposes.

4. Representatives denoted in Annex A constitute the composition of SIMAT, whichhas been determined on the basis of immediate requirements and will be subject tofurther modification, as circumstances dictate. In order to fulfil SIMAT requirements,representatives are Lieutenant-Colonel/Commander/civilian equivalent or higher,possessing no less than a SECRET-level clearance. Note that, while existingdepartmental links with external agencies will be maintained. SIMAT-specific contactswill be effected through DOS SJS.5. SIMAT will be chaired by Colonel Dave Higgins of my staff and meet at leastweekly, preceded and followed by direct reporting to DOS SJS, thereby completing thedepartmental issue management cycle.6. The initial SIMAT, to be held in the JSAT (Room 201) from 1300 to 1400 hourson 30 January 2012, will provide representatives with overarching guidance, outlineprocedural parameters, specify deliverables and establish the requisite battle rhythm.Recurring weekly meetings will take place in the JSAT on Tuesdays from 1300 to 1430hours.PRIORITIES7. SIMAT priorities will be established on a descending order of departmentalcriticality, essentiality anoVor desirability, based upon the recommendations ofrepresentatives and/or strategic direction provided.CONCLUDING REMARKS

8. Departmental exigencies are evident and I seek your support in according duepriority to this highly important undertaking. Clearly, success will be contingent upon thethoroughness, efficacy and flexibility of all concerned in fulfilling individual and collectiveresponsibilities through-SIMAT.9. Please direct any queries directly to Colonel Higgins, SJS DACV, at613-995-2511 (office), 613-286-4754 (mobile),david.hio.ginsforces.gc.ca, (DWAN).

(CSNI). or

/ Major-General/// Annexes;

Annex A DSIMAT CompositionAnnex B - DSIMAT Management Coordination MatrixDistribution List (Page 2)2/3SECRET flJMDIS) SECRET (L.MD.S)

A0383244 30-A-2012-01720 - 30


32/78

A-3/5

SECRET (LIMDIS)RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDMJLGU EN VERTU DE LALAI - RENSHGNEMENTS NON CLASSIFIES

SECRET HJMD1S)Distribution ListActionChair DSIMAT (SJS DACV)SJS DGO/DCOMNDOVCDSComd Canada COMComd CEFCOMComd CANSOFCOMComd CANOSCOMC NavalGDICMPJAGADM(PA)ADM(Pol)InformationCDSDMC ArmyC Air ForceDCINC NORADCANMILREP NATOMILAD PRMNYComd CDLS(W)Comd CDLS(L)

3/3SECRET (LIMD1S) SECRET fLIMDIS)

A0383244 31-A-2012-01720 - 31


33/78

A-4/5

SECRET (LIMDIS)

SECRET fLIMDiSIAnnex ATo 2100-1 (SJS DACV) DOS Initiating Directive - SIMAT (Delisle Case)2f"January 2012DSIMAT Composition

RELEASED UNDER THE MA - UNCLASSIFIED INFORMATIONDMJLGUE EN VERTU DEU LAI - RENSHGNEMENTS NON CLASSIFIES

A-1/1

Organization :rSIMAT Chair (SJS)VCDS/DSO

{ VCDS/CFPMj VCDS/CFNIS

C NAVALGDICMPJAGADM(PoI)ADM(PA)SJSDGOCanada COMCEFCOMCANSOFCOMCANOSCOMMNDO

' ' RepresentativeCol Higgins (Chair)Col Lander (DSO)LCol Trudeau (DPM RM)LCol Delaney (CO CFNIS)Capt(N) Plows (COS RCN) **BGen Williams (DGMS)LCol Thompson (J1 Coord)LCol Bolt (DLAW I&IO)A. Anishchenko (D Strat A)LColTheriault(SJSPA)Col Williams (A/DGO)

"

LCol Mills (A/COS)Capt(N) Eldridge (COS)Cdr Cope (SMA)** Capt(N) Hudock after 10 Feb

: " { Alternate .: .LCol RouleauLCol HumphreyCapt UttonMaj CadmanTBCMaj PouliotMaj DowS. Sixsm'rthLCol GaudetLCol DemersTBC

TBCMaj Lavigne

.

SECRETTCSECRET HJMDIS).iMuisyA0383244 32-A-2012-01720 - 32


34/78

DVGEV

DLL

R

ME

NNOFE

S

LMSWHC

E

A

BT21SSDD

nanDirev

SMDseC

77J

y2

SMAMANAGEMETC

NOMATIX

G Q CC oL

SDpc,

CoowWhukopMWlu>U

>M

.v,v.VVAx:^-^^N

B11

S

LMSW

C

E

A

A2003


35/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGUE EN VERTU DELA LAI - RENSHCMETI^nT. NON CLASSIFII

Annex B SECRET2100-1 (SIMAT) SIMAT REPORT28Sep12

CFNOC OPDIAMOND FINAL SITREP - 162200Z - 212200Z FEE 2012Commander's Assessment

1. CFNOC has completed the final stages of the Find and Understand phases of theCyber In cident Response Process. We have no t found evidence of a networkcompromise related to the activities of SLt Delisle and Network O perations havereturned to NORMAL.2.

3. Supporting an d Supported Units that ha ve items of note that they w ish to haveincluded in the Op DIAMON D After Action Report (AAR ) are asked to forwardthese to CFNOC for inclusion.4. CFNOC remains on standby to expand its OP DIAMOND effort pending furtherinstructions from the SJS Security Management Incident Action Team (SMIAT).5.

Background

6. Following the arrest of SLT Delisle, locations in Halifaxrequired inspection to ensure the confidentiality, integrity and availability of the workspaces and DND/CF IS infrastru cture.7. CFNOC was directed to coordinate technical activities on behalf of ADM(IM)necessary to return Trinity and to full operational status as a result of theIMCAThe ld20Jan 128. This incident triggered the following CCIRs:

a.

SECRET 1/3B-1/3A0383244 34-A-2012-01720 - 34


36/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGU EN VERTU DE LALAI - RENSBGN'-M :N1S HON OASSIFIE.'

SECRET;b. CCIR 6 - "Events involving DND/CF with potential to generate significantpublic or international interest (may be minor events with disproportionateimpact)"

Media interest based on CF member exfiltrating classified informationfrom CF/DND networks; and

Media interest of TSCM activities reported in Globe and Mail articles 25-28 Jan.9. CFNOC focused its efforts on the following two (2) lines of operations:

a.

10. The following major tasks were completeda. Deployed teams from CFNOC TSCM and 76 Comm Gp to Halifax;b.

c. Obtained various system OA s approvals to employ tools and equipment insupport of CFNOC's scan and data collection;d.e.

f.

g-

Completed Tasks (Since last SITREP)n.

SECRETB-2/3

2/3A0383244 35-A-2012-01720 - 35


37/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDWULGUE EN VERTU DE LALAI - RENSHGNEMB T.-. K DM CLASSIFIES

SECRET12. CFNOC AAT has completed all analysis of computer drives, images, logs andrelevant information. There was no evidence cyber exploit or malware detectedbased on current analysis capabilities. A detailed plan of AAT specific malw are,cross-validation, and extraordinary incident tests for Op DIAM OND is providedat Appendix A of this SITREP;

13. CFNOC Surveillance team completed the analysis of the following networkactivity logs for indications of malicious activity.a. SLtDelisle's account has

been analyzed - Result: NSTR; andb.

Ongoing Tasks14.

15.

16. CFNOC has begun development of an After Action Report to collect lessonsobserved from this incident and to offer recommendations on the way ahead to betterdefend DND/CF networks, with emphasis on insider threat.

Upcoming Tasks17.18. CFNOC is on standb y for possible request from SJS S MIAT instruction s for scans at

sites outside of MARLANT in response to SLt Delisle's past activities.Areas of concerns19 . CFNOC analysis in support of cyber defence for the impacted networks has been

slowed by requirem ent for third parties to prepare and hand over logs to CFNOCversus having direct access.

SECRET3/3B-3/3

A0383244 36-A-2012-01720 - 36


38/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDMILGUE ENVERTU DE LA LAI - RENSEKNEMEN'-'S N' .14 3.ASSIFIES

Annex C SECRET/2100-1 (SIMAT) SIMAT REPORT28Sep 122788 (CD Ops O)14 May UDistribution ListAFTER-ACTION REPORT (AAR) OPERATION DIAMOND1. (S) This AA R presents the timeline of actions, activities, successes, and identified gaps encountered byvarious agencies involved in OP DIAMOND. During OP DIAMON D one of CFNOC's implied tasks wasto success fully detect and mitigate potential netw ork threat posed by foreign actors. This operation was in

response to perceived insider threat follow ing the arrest of Sub-Lieutenant (SLt) Jeffery Delisle on 14 Jan12 on charges of breaching the Security of Information Act (a portion of the Canadian Anti-Terrorism Act)of 2001.2. (S) Following the arrest of SLt Delisle,

3.

4. (U) Annex A provides the detailed timeline of actions, outcomes and issues the relevant to the CyberDefence Incident Response Process for this operation.5. (U) Overall, CFNOC considers OP DIAMOND to be an unmitigated success for the managed incidentresponse process as practiced by the CFNOC Cyber Defence Operations team. The operation served has tohighlight the highly professional conduct of all Units supporting this coordinated effort. Due to thesuccesses that were seen during the conduct of OP DIAMOND, the gaps identified in this AA R will serve tofine tune the already satisfactory processes and actions, not act as the catalyst for wholesale changes.6. (U) Below are the findings based on CFNOC Cyber Defence Operations review of activities andoutcomes during OP DIAMOND. These findings have been documented in an effort to provide lessonsobserved and generate further discussi on to develop action items in an effort to enhance response time andincrease cyber defence competencies when responding to future high-level incidents of this nature.7. (S) Internal Gaps. Identified CFNOC internal gaps include:

a. An accurate list of all Network Operational Authority staff wh o need to be contacted when adecision is required needs to be established and maintained for operational effectiveness andaccountability;

C-l/3SECRET

A0383244 37-A-2012-01720 - 37


39/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATIONDIVULGU EN VERTU DE LA LAI - RENSHGNEMFNT.i ."


40/78

RELEASED UNDER THE AIA - UNCLASSRED INFORMATIONDIVULGUg EN VERTU DE LALAI - RENSHGilEM^TJ TONCLASSIFlfe

SECRET/,

9. (U) The intent is that this AA R form part of follow-on discussions and processes to close identifiedgaps, with a focus on upgradingand reinforcing the cyber defence capabilities on all CF networks,in support of CF missions.10. (U) Of note, the support provided to CFNOC during OP DIAMOND by the following CF/DNDpersonnel wasoutstanding:

a. MARLANTISSO (Mr. Bill McFadden)an d staff;b. TSAANS (Mr. Scott Costello an d MCpl Keith Richards);c. the following Operational Authorities or representatives for DWAN (Mr. Len Bastien), CSNI

(LCol Dave Yarker), an dd. 76 Communications Group Ops (Capt Derek McDowell and WO Marc Gervais);e. ; andf. SABNS 3 (Mr. Mark Eisenstat, Mr. Ty Lo, and Mr. Jeff Pilgrim).

11. (U) Questions can be directed to Captain Scott Durno, CFNOC Cyber Defence Operations Officer at945-7414.

Alex TupperLColCO CFNOC945-7400Annexes:Annex A - Detailed Timeline

Dist ListActionCF J6 CoordSJS Support OpsInfoIMCAT SecretaryEMCAT MembershipC-3/3

SECRET.A0383244 39-A-2012-01720 - 39


41/78

SED UNDER THE AIA - UNCLASSIFIED INFORMATIONIVULGUE EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFIES

Annex D2100-1 (SIMAT) SIMAT REPORT28Sep 12

ADVICE FOR THE MINISTER

MISCONDUCT

ISSUE: We have heard of allegations of misconduct involving CFmembers, both as victims and perpetrators. What measures are beingtaken to protect CF membersand reduce instances of misconduct?The Canadian Forces take all allegations of misconduct by personnelvery seriously.The Canadian Forces also have a range of support services for membersand families, and our highest priority is to the victims of any crimes.We hold our members to a very high standard of conduct andperformance through a number of mechanisms, including the CodeofService Discipline, and where applicable, the Criminal Code of Canada.

IF PRESSED ON ALLEGATIONS OF SEXUAL MISCONDUCTCanadian Forces members are subject to the Code of Service Disciplineand are therefore held to the highest standards of professional conductthat is consistent with the values and expectations of all Canadians.Members of the Canadian Forces are required by regulations to bringbreaches of the law by CF members or other military force partners tothe attention of the appropriate authorities.All incidents of misconduct are to be reported, investigated and, wherewarranted, charges are laid. A CF member found involved in a case ofsexual misconduct is liable to criminal, disciplinary and administrativeaction, including possible release from the CF.F PRESSED ON HARASSMENT AND ABUSE POLICY

The Department of National Defence conducts mandatory harassmenttraining for all civilians and military members, has created a series ofcomplaint and support mechanisms for individuals who are victimsofsexual harassment, and works hard to foster a work environment wheresuch conduct is not tolerated.To that end, the Departmentof National Defence and the CanadianForces are strongly committed to providing a workplace that is free ofharassment and discrimination, and that promotes teamwork, mutualrespect and fairness forall.Where issues do arise, CanadianForces members have access to anumber of channels to submit a complaint, including: Military Police; A Help Line for member assistance; The Chain ofCommand; The Canadian Forces Grievance Process; The Office of the Military Ombudsman.

-1/6 40


42/78

LEASED UNDERTHE MA - UNCLASSIFIED INFORMATION/ULSJE EN VERTU DE LA UU - RENSEIGNEMENT5 NON CLASSIFY

IF PRESSED ON CHARG ES AGAINST SLT JEFFREY DELISLEThe Canadian Forces take the security of sensitive information veryseriously.All CF personnel handling sensitive informa tion observe stringentprocedures to protect its security and are held to a high ethicalstandard, consistent with the core military values of honour and loyalty.Following a comprehensive investigation by the RCMP, with assistanceprovided by the Canadian Forces, SLt Delisle has been charged w ithoffences under the Criminal Code of Canada and the Security ofInformation Act.I cannot provide further details regarding the nvestigation conductedby the RCMP, as it is within the purview of the Commissioner of theRCMP to provide comment.This case is currently being considered in a Court of Law and SLtDelisle shall be affo rded every opportunity to a fair and impartial trialwithout any conjecture from the MND.

D-2/6" AQ303244 4l-A-20'l2-0172l!) - 41


43/78

RELEASED UNDERTHE MA UNCLASSIFIED INFORMATIONMVULGUg EN VERTU DE LA LAI - RENSEIGNEMENTS NON CLASSIFY

BACKGROUND: MISCONDUCTALLEGATIONS OF SEXUAL MISCONDUCT- If, after an investigation of a complaint, a member is determined to have ongagod in sexuamisconduct, appropriate a dministrative steps will be considered depending on thecircumstances. These measures can include, but are not limited to:

o Initial counselling;o Recorded warning;o Counselling and probation; oro A recommendation of release.- In addition to the administrative measures outlined above, the Commanding Officermayconsider a member's conduct to warrant disciplinary action and/or even relief from theperformance of military duties.- If a member who is the target of the offensive behaviour is uncomfortable going to thechain of command, the CF have initiated a number of alternative systems to address theconcerns of its members. These include the Canadian Forces Military Assistance Program(CFMAP) "1-800" number, the National Investigation Service, and the Ombudsman's Office.- All DND employees and CF members at all levels and ranks also receive training on heissues surrounding workplace harassment, how to avoid and address inappropriatebehaviours, and what mechanisms are available to an individual for reporting harassment.MEDIA BACKGROUND: MISCONDUCT

On 17 Jan 12, media reported on the 13 Jan 12 arrest of SLt Jeffrey Paul D elisle, asthe first person to be charged under the Security of Information Act. In international news,Reuters quoted Minister MacKay saying "Let me assure you our allies have full confidence inCanada."On 18 Jan 12, media indicated that SLt Delisle was reportedly passing information toRussia, however DND did not confirm which entity received the material.On 19 Jan 12, media reported on a statement by the CDS maintaining that the CFtakes the security of information very seriously and is always mindful of the effects of leaks.On 20 Jan 12, media reported that four staff of the Russian Embassy had beenexpelled in 'retaliation for Russia's alleged involvement in an espionage case.' Neither thePMO nor the Department of Foreign Affairs commented on the matter noting it was a matter ofnational security, and the matter was before the courts.On 09 Feb 12, media reported the Russian Ambassador to Canada as saying thatMoscow has an agreement with the Canadian government to keep quiet about any connectionbetween Russia and the case of SLt Delisle.On 28 Feb 12, media reported that SLt Delisle's bail hearing was set for 13 Apr 12.

On 13 Mar 12, media reported on the ann ouncement of an earlier date for the bail hearing ofSLt Jeffrey Delisle. According to the media, the date of the bail hearing was moved forwardfollowing a request from his lawyer, Mr. Mike Taylor, and is now scheduled for 28 Mar.On 13 Mar 12, media reported on the delay of the trial of Pte Andrew Norman Wilsonuntil Dec 12. Media reported that Pte Wilson, a combat engineer posted to CF B Edmo nton, ischarged with assaulting an American couple in Halifax in 2010.On 15 Mar 12, media reported that the case of SL1 Jeffrey Delisle, accused of sharingclassified information with a foreign entity, has significantly damaged Canada's intelligencesharing relationships with key allies. According to the media, the extent of the leaks appearunknown an d date back sev eral years, even though SLt Delisle was allegedly only undersurveillance for a few months. The media noted that although the M inister of NationalDefence, Peter M acKay, has stated that allies retain "full confidence in Canada," the case hasraised questions about the security clearance process.On 21 Mar 12, media reported that assault charges against CFB Gagetown soldierMarkus Alexander Scott have been dropped.On 24 Mar 12, media rep orted on the court martial of MCpl C.J.S. Agnew who was

fined $500 for falling asleep while guarding the aircraft of the Prime Minister during a trip toMorocco in Jan 11.On 28 Mar 12, media reported that-the alleged leak of military intelligence to Russia bySLt Jeffrey Delisle may have created a significant rift betwe en Canadian and Americansecurity officials. According to the media, a recent article in the Wall Street Journal alsoclaimed that the volum e linked to the breach was on the same level as the data loss the USexperienced through WikiLeaks. Media noted that spokesperson for the Minister of NationalDefence Jay Paxton would not speculate on hearsay, but stated that, 'The minister has beenclear that ou r allies remain fully confident of Canadian d efence activities. That point wasreiterated by the visit of MND MacKay's American and Mexican counterparts [Tuesday]."

D-3/6 42-A-29+2-01720^ 42


44/78

RELEASED UNDER THE AIA - UNCLASSIFIED INFORMATION

DMJLGUS EN VERTU DE LALAI - RENSEIGNEMENTS NON CLASSIFIES

On 28 Mar 12, media reported that the bail hearing for SLt Jeffrey Delisle is scheduledto begin tod ay in Halifax. According to the media, SLt D elisle's lawyer, Mr. Mike Taylor, statedthat the Crown is opposed to his release.On 29 Mar 12, media reported on the bail hearing of SLt Delisle and testimo ny by U.S.special agent James D ougherty. According to the media, Mr. Dougherty, an FBI expert inRussian intelligence and counter-intelligence, testified at the bail hearing in addition to SLtDelisle's brother, mother and aunt. Media noted that all of the testimony is covere d under theterms of a publication ban, which was grante d at the request of the defence. Media addedthat a decision on SLt Delisle's bail is expe cted this Friday at the earliest.On 29 Mar 12, the Toronto Sfarpublished an opinion piece regarding the allegations ofespionage against S Lt Delisle. Accord ing to the article, the Governm ent is maintaining a highlevel of secrecy surrounding the case whe n there is no reason to prevent details from beingreleased, aside from embarrassment over the incident. The article questioned whether alliescontinue to have "full confidence" in Canada, as stated previously by the M inister of NationalDefence.On 29 M ar 12, media reported that Mr. Joey M edaglia, who was unde r investigation forhis alleged connection to organized crime, no longer works for DND as of 27 Mar. Accordingto the media, Cmdr Hubert Genest, director of public affairs for the RCN, reportedly stated,"While Mr. Medaglia no longer works for the Department of National Defence, he is free toapply for other jobs within the federal public service. No other information can be shared aboutMr. Medaglia for privacy reas ons." Media added that M r. Medaglia was an adm inistrativeassistant to RCN commander VAdm Paul Maddison.On 30 Mar 12, media reported that SLt Delisle has been denied bail. Media noted thatthe case is scheduled to resume on 8 May.On 31 Mar 12, media reported on speculation that secret memos w arned of anespionage threat in the months leading up to the arres t of SLt Jeffrey Delisle. According todocuments obtained by Ken Rubin under /Access to Information and shared with the Globeand Mail, the partly redacted summaries from 2011 reveal the prospe ct that NATO soldierscould be "exploited" by embassy-based Russian spies seeking to buy information. Mediareported that none of the general warnings fro m this period appear to h ave pinpointed thespecific threat of SLt Delisle.On 03 Apr 12, media reported on allegations that a CF soldier convicted of sexu alassault was given a sentence that was too lenient. According to the media, the sentence ofsix years was in part a result of arguments that he suffered from PTSD.On 10 Apr 12, media reported that two CF members are accused of theft and relatedcharges are scheduled to appear in BC Provincial Court today. According to the media,reservist Ryan Verhoeks and Cory Wagner have each been charged with theft over $5,000and a number of other charges. Media added that the charg es are the result of aninvestigation into a break-and-enter and theft at a Nanaimo fast food restaurant on 24 Dec 11.On 18 Apr 12, media reported that a Sarnia-area wom an has filed a $1.3M civil suitagainst military medic James W ilks and DND. Media noted that Mr. Wilks was convicted bycourt martial and sentenced to 10 months in jail for sexual assau lt while conducting healthscreenings of potential recruits. Accord ing to the media, the suit alleges that Mr. Wilks wasnot properly supervised by DND at the time she was assaulted by him in 2009. Media addedthat the suit also claims that DND did not follow departm ental policy and failed to act onprevious complaints against Mr. Wilks.On 23 Apr 12, media reported that CFB Gagetown soldier Christopher William Grinhampleaded not guilty to sexua l assault in provincial court on Friday. Media noted that the trial isscheduled for 11-12 Sep 12.On 25 Apr 12, media reported on the court martial of Lt(N) Loren Pearson at CFBEsquimalt ye sterday. According to the m edia Lt(N) P earson pleaded guilty to assault andharassment against a female officer he was training during a deployment aboard HMCSOttawa in 2011. Media noted that Cdr John Allsop, the ship's Commanding Officer, testifiedat the court martial, stating that after the assault, he ordered Lt(N) Pearson to be sent back toCanada im mediately. Media reported that the sentencing of Lt(N) Pearson is scheduled for 26April. On 28 Apr 12, media reported on the sentencing of Lt(N) Loren Pearson regardinginappropriate sexual advances towards a junior officer whom he was training while ondeployment. According to the media, Lt(N) Pearson was given a severe reprimand and fined$8,000.On 01 May 12, media reported on the alleged espionage case of SLt Jeffrey Delisleand drew comparisons to the trial of US Army Pte Bradley Manning, who is accused ofpassing class ified documents to Wikileaks. According to the media, SLt Delisle represen ts themore serious case, arguing that naval secrets ma y have been delivered to Russia over fiveyears that could jeopardize NATO security and damage Canada's reputation. Media notedthat SLt Delisle's next court appearance is scheduled for 08 May.D-4/6 -43


45/78

LEASED UNDER THEA - UNCLASSIFIED INFORMATIONWULGUE E N VERTU OF. LA LA! - RENSEIGNEMENTS NONCLASS!

On 03 May 12, media reported on four members of the RCN that are accused ofimpersonating police officers in Nova Scotia. The next court date is scheduled for 16 May.On 07 May 12, media reported on a complaint against a solider at CFB Shilo forallegedly committing a "lewd act" on base. According to the media, the solider has not beennamed, because no charges have been laid at this point.On 10 May 12, media reported that DND has recalled an internal booklet afterdiscovering that it contained a photo of convicted killer Russell Williams. According to themedia, a written statement from Defence Minister MacKay apologized, stating, "This is aterrible mistake for which the Canadian Forces are truly sorry."On 17 May 12, media reported that four members of the RCN accused ofimpersonating police will be given the opportunity to avoid having a criminal record and willinstead be referred to N ova Scotia's adult diversion program.On 22 May 12, media reported on SLt Delisle and the reasons w hy the Governm entdid not disclose the alleged involvement of Russia. According to the media, Defence MinisterPeter MacKay reportedly argued for a measured and nuanaced approach to the crisis, whichcontinues to threa ten Canada's relationship with its allies.On 23 May 12, media reported on SLt Delisle and speculation that Ame ricanintelligence officials supplied vital information in the initial investigation that led to chargesagainst him. Media claimed that the case has embarrassed DND, which is now attempting torestore confidence in its ability to keep secrets.On 28 May 12, media published an opinion piece by Peter Worthington regarding SLtDelisle and Canada's attempts to downplay the allegations to avoid damaging relations withRussia. According to the a rticle, there is reportedly concern among the inner Cabinetmembers about how to deal with the SLt Delisle case, with Defence Minister Peter MacKayreportedly urging caution.On 06 Jun 12, media reported on international maritime security cooperation andcomments by US VAdm David Buss regarding SLt Delisle. According to the media, VAdmBuss stated that desp ite the recent arrest of SLt Delisle on allegations of sharing classifiedinformation with a foreign entity, Canada has not lost the trust of its allies. Further, VAdm Bussreportedly stated that he expe cts part of the outcome of the SLt Delisle case to be that nationswill review safeguards to ensure that information passed betw een allies is protected.

On 08 Jun 12 media reported on the sentencing of Jason John Ouimet, a former soldierwith the 1 Regiment Royal Canadian Horse Artillery, CFB Shilo, for five years in prison formanslaughter in the beating death of Duane John Lacquette.On 14 Jun 12, media reported on the trial of SLt Delisle and that his lawyer, MikeTaylor has received another adjournment in order to review the large volume of documents.According to the media, Mr. Taylor stated that he does not have an issue with the wayprosecutors are handing over material to him although he added that, "A lot of it is blacked outfor some obvious reasons I guess and I have to make a determination as to whether I want tochallenge any of that information." Media noted that the case is scheduled to resume on 04July. On 15 Jun 12, media reported that Diane Marie Larose, a form er DND employee, wasgiven probation for fraud after she attempted to request thousands of dollars for her personalaccount from a foreign exchange in Ottawa on 05 Oct 2010. According to the article, Ms .Larose attempted to use a promissory note that said she had full authority from CDS GenWalter Natynczyk and Defence Minister Peter MacKay for $2M a month to fund urgentmissions and disaster relief in Canada. Media noted that the manager was reportedlysuspicious and that it was confirmed that this is not the way that DND doe s business.On 17 Jun 12, media reported on charges of child pornography against MCpl ClaytonHolloway of CFB Edmonton who had been serving in Afghanistan. According to the media,MCpl Holloway h as been repatriated in order to face charges under the military justice system.On 05 Jul 12, media reported that the case of Sub-Lieutenant Je ffrey Paul Delisle hasbeen set over until 17 Jul 12 owing to his lawyers asking for more time to analyse material thathad just been disclosed by the Crown.

On 10 Jul 12, media reported that the Canadian Forces sergeant Christian Boudreauhas been demoted to corporal and faces dismissal from the military after he was convicted offive counts of breach of trust and five of behaving in a disgraceful manner regardinginappropriate medical examinations of female recruits from 2003 to 2009.On 17 Jul 12, media reported that Canada has no interest to try SLt Jeffrey Delislepublicly, as it is not in Can ada's national security interest to exp ose publicly wh at happenedand how it happen ed. The article mentioned that the lawyers in this case are exp ecte d to meetin court again that day.On 18 Jul 12, media reported that SLt Jeffrey Paul Delisle's lawyer asked that his clientbe tried in front of both a judg e and a jury. It was reported that the preliminary investigationcould start in autumn 2012 or in winte r 2013.

D-5/6 44


46/78

lASS> UNDER THE A1A - UNOASSIRED INFORMATION

IVULGUE EN VERTU DE LA IAI - RENSEIGNEMENTS NON O

On 19 Jul 12, media reported that Col Bernard Ouellette, who was dismissed from hiscommand in Haiti two years ago amid allegations of an inappropriate relationship, is suing theDepartment of National Defence and fellow officers for defamation. Col Ouellette reportedlydenied any wrongdoing and is seeking $6.2M in damages as well as an apology and acorrection to his service record.

On 19 Jul 12, media reported that the preliminary inquiry in SLt Jef frey Delilsle's trialwill start on 10Oct12.On 19 Jul 12, media reported that CF member Jamie Espirito-Santo has beensentenced to four months in jail for an assault that left a stranger with a broken jaw andseveral other injuries

On 20 Jul 12, media reported that a Beamsville artist formerly accused ofimpersonating a military officer has launched a S7.8M civil suit against the Minister of NationalDefence, because he claims that he is a military officer and had not been paid for close to 20years' work as an undercover agent gathering intelligence for the military and the RCMP. Itwas reported that Canadian Forces officials admitted the artist enlisted in the military in 1990.On 20 Jul 12, media reported that the Canadian Forces Grievance Board ruled inDecember 11 that Gen Walt Natynzcyk, the Chief of the Defence Staff, should compensateCol Ouellette for his lost benefits, take steps to restore his reputation and put him back on hisprevious career path. Col Ouellette was stripped of his command in Haiti for allegedly havingan inappropriate relationship. Gen Natynzcyk has reportedly not yet responded to thegrievance board's recommendation.On 25 Jul 12, media reported that Australian officials, including the Australian High

Commissioner to Canada Louise Hand, were briefed by the Canadian government on theactivities of SLt Jeffrey Delisle shortly after his arrest for espionage in January. Media addedthat the Australian Security Intelligence Organization was also briefed on SLt Delisle's case bythe Canadian Security Intelligence Service.On 25 Jul 12, the Edmonton Sun published an opinion piece by Peter Worthington thatnoted the lawsuit launched by Col Bernard Ouellette against DND over his dismissal fromcommand in Haiti after allegations of inappropriate behaviour with a UN official.On 26 Jul 12, media reported that highly classified intelligence from Britain, Australia

and New Zealand may have been compromised by SLt Jeffrey Delisle. According todocuments released under Austral ian freedom of information laws and reported on in theSydney Herald, SLt Delisle had access to the 'Five Eyes' intelligence and the leak resulted inhigh-level consultations between the Australian and Canadian governments, as well as asecret international conference in New Zealand earlier this year. Media speculated that thebreach has damaged Canada's security relations with some of its key allies, while Canadiansecurity experts Martin Ruder of Carleton University and Christian Leuprecht of the RoyalMilitary College and Queen's University reportedly suggested that the case is unlikely to causemuch of a rift among allies.On 30 Jul 12, media reported hat a solider at CFB Shilo was shot early Sunday and thatanother solider is in custody following an altercation at CFB Shilo. According to the media, the soliderwho was shot reportedly suffered non-life threatening injuries and that the used weapon is not amilitary-issued weapon. Media added that the incident is being investigated by the CF NationalInvestigation Service but that no charges have yet been laid.On 31 Jul 12, media reported on chargesof attempted murder and weapons offences againstMCpl Clarence Joseph Stillmanof CFB Shilo in connection with the shootingof another soldier at CFBShilo on 29 July. According to the media, the CF National Investigation Service is investigating.Responsible Principal(s): VCDS, SJS, CMP, JAGContacts: LCol Peter Allan, EA/VCDS, 992-6055Maj Stewart Taylor, EA DOS SJS, 996-8396

Cdr Mary Gardam, SA/JAG, 996-8998John Roche, SA/CMP, 943-6815Capt Kevin Winfield, EA/CFPM, 949-1021LCdr Jordan Holder, PAO/ADM(PA) SJS, 992-9049

Joanna Hruskoci (D Parl A 2-4) 992-1022Summer 2012

D-6/6 AU383244 45-A-2012-01720 - 45


47/78

RELEASED UNDER THEAIA - UNCLASSIFIED INFORMATION

mnex E100-1 (SIMAT) SIMAT REPORT8Sep12National DefenseOelenca nationals

MEDIA MONITORING & ANA LYSIS SUM21 JAN-30 APR 12; 9 M A Y - 5 SEP 12

:iat ra VERTU DE LA LAI - RENSEIGNEMENTS NON OASSIFII

Media Monitoring andAnalysis - ADM(PA) Surveillance et30 April 201 2SLT JEFFREY PAUL DELISLECanadian media coverage

ENS 1 JEFFREY PAUL DELISLECouverture mediatique canadienne

Main themes / Fails sail lants :

Le30avril2012

" 173 articles (151 English, 22 en francais) were .published. n domestic media from 21 January to; 30 April 2012, regarding SLt Jeffrey Pa'ul Delisle and issues surrounding espionage;o Seven articles were published in international media; .- - Ourinc 1he frionit6redlpefibd,1he journalists that generated the most coverage on the issue were:

- ; . Sleveh Chase and Colin Freeze (Globe & Ma//, 4); Michael Tuttbn (Toronto Star, 4); Steve Bruce(Halifax Chronicle-Herald, tyJeti Daws (Postmedia, 4); and PeterWorthirigton (Sun Media, 3)Editorial cbmrnentery^iBpreserrted "9 per cent' of total coverage (17 itenis)vThe overall tone of' : ^ secrets '-Oelisie could have been' ' ' ' '

' privy to; -

Executive Summ ary / Somm aire executiveOn 17 January, several Canadian news sources reported on the 13 January arrest of SLt Jeffrey Paul Delisle.Postmedia,' CP, the Globe and Mail. QMI, the Halifax Chronicle-Herald and the Fredericton Daily Gleanernoted SLt Delisle was charged with communicating information that may "increase the capacity of a foreignentity or a terrorist group to harm Canadian interests." Th e articles indicated the Navy Intelligence Officer is thefirst person to be charged under the Security of Information A ct, which came into effect in 2001 as part of apackage of anti-terrorism laws. On 18 January, the Kingston Whig-Standard and the National Post indicatedSLt Delisle was reportedly passing information to Russia, however, DND never confirmed which entityallegedly received the material. On 19 January, a CP article noted CDS Gen Walt Natynczyk made his firstpublic comments on the case. In a written statement, he maintained the military takes the security of sensitiveinformation very seriously and is always mindful of the effects of leaks.On 21 January, a Postmedia article reported authorities fed SLt Delisle fabricated information as part of a "sourmilk" counter-intelligence ploy to taint the credibility of secrets he was suspected of passing to Russia. Thearticle noted once naval officials suspected there was a spy in their midst, deliberately flawed information wasbaited and designed to eventually be discovered by its foreign recipients. Michel Juneau-Katsuya, a formerintelligence o fficer with CS IS, said the deception is believed to have worked and now "they don't know what istrue and what is not and will have to be suspicious of pretty much every thing [given to] them." He added,"This was done by the book - sour milk so that you confuse the other side."In March, the Globe and Mail's Colin Freeze and the Wall Street Journal published articles indicating the caseof SLt Delisle has done significant damage to Canada's relationships with key allies, mainly the U.S. The WSJ

A0383


48/78

RELEASED UNDER THE AM - UNCLASSIRED INFORMATION

DMJLOl EN VERTU DE LALAI - RENSHGNEMENTS WON CLASSIFIES

article reported details regarding what information was leaked have not been made public, but the articleclaimed a source familiar with the matter said it was "military signals information, or electronic commun icationscoming from allied and other state militaries and it was leaked to the Russians." Artic les published in theToronto Star and Postmedia reported on the WSJ article, noting a fallout between the U.S. and Canadacaused by the leak of information, was "downplayed by Canadian officials." Jay Paxton, a spokesperson forMND Peter MacKay, stated: "I can't speculate on hearsay. The minister has been clear that our allies remainfully confident of Canadian defe nce activities. That point was reiterated by the visit of Minister MacKay'sAmerican and Mexican Counterparts." The Star added leaked information by SLt Delsile reportedly touched ona sys tem viewable by the Five E yes, an intelligence alliance b etween the U.S., U.K., Canada and NewZealand. On 31 March, the Globe and Mail reported in the months before the espionage arrest of SLt Delisle,the military quietly circulated "secret" memos warning against growing spy threats, including the prospect thatNATO soldiers could be "exploited" by emba ssy-based R ussian spies seeking to buy information. Acco rding tothe article, "the Canadian Forces unit noted that the defence attache - who had been expelled - was (like mostRussian defence attaches) presumed to be a member of the Moscow-based military spy service known as theGRU."During the monitored period, several articles were written regarding SLt Delisle's lawyer, Cameron MacKeen,withdrawing from the case in January and on the rescheduling of his many bail hearings. On 31 March, theCharlottetown Guardian reported Judge Barbara Beach turned down SLt Delisle's application for bail.Canadian Intelligence Centres / Centre d'intelligence canadiensIn early January, the Halifax Chronicle-Heraldpublished two articles describing HMCS Trinity CommunicationsCentre. A 28 January article published in the Globe and Mail noted HMCS Trinity stores some of the most"sensitive" military intelligence available in Canada and collected by international allies as well. The NationalPost published an article on 18 April, discussing the history, growth, and workings of CSEC. The article notedCSEC is thought to have played a role in catching Sit Delisle. On 19 April, the Fled Deer Advocate publishedan article discussing the closure of the Acoustic Data Analysis Centre at CFB Esquimalt. The article mentionedthe operations will be transfe rred to a similar ce ntre in Halifax.Arctic Espionage / Espionage dans I'ArctiqueAccording to an article published in ten Postmedia dailies on 18 January, SLt Delisle's case could beconnected to an ongoing territorial dispute in the Arctic. According to Michel Juneau-Katsuya, SLt Delisle'sduties in Halifax included monitoring the North Atlantic seas. Juneau-Katsuya added SLt Delisle had access tosensitive information, including the locations of ocean sensors that help monitor ship movements. In a SunMedia article, Rob Huebert, a naval and defence policy teac her at the University of Calgary said Cana da'sArctic is "ripe for spying." The article noted Canada is developing enhanced land