Understanding Trends in Terrorist Financing

This research is driven by a grievance. It irks me endlessly when trends are presented in academic research or media commentary as “new” or “increasing” without any evidence to support these assertions.

So I decided to put my money where my mouth is and create the evidence I would need to make statements like that. Eight years ago, I started collecting “cases” of terrorist financing. These are incidents of individuals or groups engaging in terrorist financing activity from around the world. Readers of the Global Terrorism Financing Report will find this framing familiar: we use this case approach to populate that report.

In our data, a case of terrorist financing is any reported incident of terrorist activity financing – that is, any financial activity that was used to support terrorist activity. This activity is further broken down into six mechanisms: how terrorists raise, use, move, store, manage, and obscure the source, destination, and use of those funds. Again, this will feel familiar to many readers, because it’s the typology I developed in Illicit Money. We further capture information on the methods used within each of these mechanisms, from things like cash couriers to hawalas to cryptocurrency and much more.

Our definition of terrorism is equally important to understand. We use a definition I developed for both Women in Modern Terrorism and Illicit Money, which draws heavily on the Canadian Criminal Code definition of terrorism. For us, it’s less about the ideology or group and more about the activity. In short, we’re looking for cases of violence (planned or disrupted) with a religious, ideological, or political motivation, intended to influence or intimidate a population (this can be as few as one person, such as a politician, or as many as an entire country).

Share

Terrorist Financing Analysis

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals, helping them learn about terrorist financing and analyze suspicious patterns to disrupt terrorist activities more effectively. Sign up today to grow your counter-terrorism expertise.

Data Collection

We find these cases in open sources: in things like media reports, when our friends at CourtWatch report on indictments, from government reports, etc. We don’t use covert methods to collect this data, but we will include information released publicly that might have used covert methods.

We use a robust method to validate the data. First, a researcher finds all the relevant cases and writes them up for the Global Terrorism Financing Report. I then review the draft report and make any required deletions (for things that don’t fit our criteria). A second analyst then inputs these cases into the database, where I review them again. Finally, I do a tertiary review when I pull the data and conduct analysis.

Ultimately, this has yielded over 21,000 data points across 1150 records and 19 fields. These fields include coding for group, country, a text description of the case, the methods and mechanisms used, and of course sources. While there is data from 2018 onward, we only use the data from 2020 and onward because it’s more reliable. (It’s when I hired staff).

What We’ve Found

On average, we capture about 190 cases per year, although 2021 and 2022 had the lowest amounts of data. This might be due to a lack of terrorist financing, a lack of disruption/detection of terrorist financing, or other factors. In my experience, data blips like this generally result from a combination of factors.

Each year, we usually see the most reporting on how terrorists raise money. However, we also see lots of information on how they’re hiding that money. Less often reported is information on how terrorists are managing and storing funds. These mechanisms are likely harder to detect and less sexy to report on. However, they’re still critical for understanding (and more importantly, disrupting!) terrorist financing.

The Limitations

There are plenty of limitations with this dataset (like all datasets). Firstly, as mentioned previously, there is no covert collection. This means we are certainly missing some trends and methods in the world of terrorist financing. Secondly, there are limitations to the data we can capture. Some of this is due to language, but it’s mostly due to time limitations. As this project is entirely funded by my company, Insight Threat Intelligence, I can’t assign unlimited resources to data collection.

Thirdly, the data is limited to observable and reported data. We don’t have visibility (through this data collection method, anyway) of harder-to-identify terrorist financing methods. For instance, I think that the use of hawala is likely underreported in this data. Other methods and mechanisms are also likely underreported. Fourthly, there is likely a lag in the data in terms of when we see trends emerge. Disruptions, arrests, prosections, and even investigative journalism all takes time. This time creates a lag between when a terrorist financing method or mechanism occurs, and when it gets reported publicly. So while this is the only dataset like this in the world, it does have a time lag.

And finally, definitions matter. While I have confidence in the definitions that we use, a broader definition of terrorism would capture more information. A narrow definition might yield more nuanced results. Part of the way we correct for this is through the use of filters and the ability to exclude entire classes of cases, like the recently listed criminal organizations. (While I think these do meet the legal threshold for listing as terrorist entities in Canada, I fundamentally think they operate differently from terrorist groups; as such, they should be analyzed separately.)

These limitations might seem daunting, but for me, it’s really about properly contextualizing our findings. We keep these limitations in mind as we write, so we never get out ahead of our skiis in our analysis.

Next Steps

If you stuck with me this long, that means you’re very likely a huge data nerd. Thank you! This series is right up your alley. There’s lots more to report on, so stay tuned for the next edition of the series on Trends in Terrorist Financing. You will see separate newsletters outlining how terrorists raise, use, move, store, manage, and obscure their funds, as well as a summary newsletter on key findings. We will likely publish this series once a month, so you’re in for a bit of a slow burn. Also, this series will only be available to paying subscribers, since they’re the ones supporting this database development. So if you want to read it, you know what to do!

Share

© 2026 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Why Now?

Terrorist financing is no longer limited to bank accounts and cash smuggling. As I’ve written elsewhere, cryptocurrency has become a major tool for terrorist financiers, especially when other channels are too costly or risky. Beyond crypto, we’re seeing terrorist organizations explore everything from crowdfunding platforms to gaming gift cards as ways to raise and move money.

At the same time, regulation of financial technologies varies dramatically from one country to the next. Some states take a hands-off approach in a bid to attract innovation and investment. But this variation creates a familiar problem: jurisdictional arbitrage. Terrorists and their support networks exploit gaps between jurisdictions. When one state lags behind in regulation or enforcement, it becomes a soft spot in the global financial system.

The Algeria Principles are a response to this growing threat.

What Do the Principles Actually Do?

To be blunt: not much—yet. They are non-binding, so they don’t impose any legal obligations. But their real power lies in the groundwork they lay for future action.

• Foundation for future UNSC resolutions: The Principles can serve as a policy base for more robust measures down the line.

• Support for research and policy work: Researchers and NGOs can point to the Principles as UN-endorsed recognition of a specific threat vector.

• Anchor for engagement: States can reference the Principles in developing public-private partnerships (PPPs), especially when reaching out to fintechs and tech companies for collaboration on terrorist financing risks.

In short, they create a shared reference point in an area that desperately needs one.

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

The Algeria Principles will impact several different sectors implicated in the fight against terrorsit financing:

• Regulators, especially those in financial supervision and sanctions enforcement, will find a roadmap for updating risk assessments and regulatory approaches.

• Reporting entities, including traditional financial institutions and virtual asset service providers, should understand how these principles could shape expectations regarding their internal controls.

• Fintech companies will better understand why states are increasingly approaching them not just about anti-money laundering (AML) concerns, but specifically about counterterrorist financing (CTF).

That last point is critical. For too long, CTF has been treated as an AML afterthought. The Algeria Principles shift the focus explicitly to terrorist financing, recognizing that it requires distinct tools, partnerships, and understanding.

There are four key principles, and while they are expanded on at length (often with good and interesting suggestions for engagement and mitigation), they can be boiled down to the following:

• Enhance understanding of terrorist financing risks in fintech

• Develop and implement risk-based, proportionate regulation

• Detect and disrupt the abuse of new technologies

• Evaluate the impact of CTF measures on new technologies

Read the full document here.

Today’s Principles are Tomorrow’s Laws

The Algeria Principles aren’t revolutionary, but they are a necessary first step towards more engagement and possibly more regulation. They signal a recognition at the highest levels of international policymaking that terrorist financing has changed—and that our tools, partnerships, and policies need to change with it. If you work in fintech, regulation, compliance, or financial intelligence, these principles should be on your radar.

Share

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Today, I will explain why everyone should care about money laundering: It directly impacts our well-being, both physically and economically. Hopefully, by the end of this article, you’ll be raging mad that anti-money laundering isn’t at the top of the political agenda in your country.

Enabling Crime

The first issue is a fairly obvious one, although the direct impacts on personal well-being are one step removed from traditional crime, making it harder to understand. A lot of crime (maybe most?) is motivated by profit. Drug traffickers sell drugs to make money, thieves and fraudsters steal money and goods for profit (or to re-sell for profit), and human traffickers buy and sell humans to make money. It’s easy to understand the negative effects these crimes have on people: anyone who has ever been a victim of fraud or theft or had someone they know be victimized in this way understands the sense of insecurity even a minor incident can create (let alone the violence that often accompanies these activities). We all want less crime.

It’s harder to see the direct impacts of “white-collar” crime. Tax evasion, embezzlement, and insider trading are all forms of theft from governments, businesses, and individuals that ultimately make us all poorer and a select few much, much richer. Tax evasion is theft from the government (and, by extension, its citizens). Embezzlement is theft from a company or organization (and its shareholders, employees, or investors), and insider trading is theft from investors (by using confidential information to make better deals or advantageous trade to the detriment of people who don’t have that information).

Think about the case of Enron. Back in 2001, the company declared bankruptcy after officials embezzled tens of millions of dollars, causing the company to collapse. This destroyed the pensions and savings of thousands of people, including pensioners and shareholders of the company. Image a similar situation with your investments: would you be okay with losing $5,000, $10,000 or more to an embezzlement scheme? I know I wouldn’t.

Anyone who invests in public markets will recognize the impact this can have: lower profits and unfair wealth distribution. But what about people who don’t invest in public markets? Are they impacted? They are if they have any pensions or state benefits. For instance, in Canada, every Canadian is a pension holder in the Canada Pension Plan (CPP). The CPP investment board invests the plan's money from employers and employees. So, ultimately, every Canadian is an investor in public markets. So-called “white collar” crime affects everyone, but the more money you have in public markets and pensions, the more impacted you are.

So, we can agree that these crimes are bad, but what about the role of money laundering? Once criminals have gotten money from these activities, regardless of whether it is human trafficking or insider trading, they need to hide the source of funds. This is because if they don’t, as soon as law enforcement realizes what they are doing, they can freeze and seize those funds. Criminals have to hide the source of funds, making it hard for authorities to determine where the money came from. This is money laundering and is what makes these types of crimes profitable. Without money laundering, it would be easy for law enforcement to remove the profit motive of crimes. Would a drug dealer continue to sell drugs if the police could just come along and take all their money? Would people under-report their income and use elaborate schemes to make it appear like they made less money than they did if law enforcement could identify the discrepancy and seize unreported income? Probably not.

“…money launderers are as vital to criminals as getaway drivers are to bank robbers. Without them, there would be no loot.”

You’re probably thinking: yeah, maybe these activities have a direct impact on my bottom line, but that impact is spread out across the entire population, so I’m only harmed a little bit. And maybe that’s true. And if you’re willing to let criminals make money off you because tackling money laundering is hard, I guess that’s your choice. But what happens if a country’s money laundering problem becomes so big that it creates other harms, like distorting markets and undermining legitimate business?

Market Distortion & Manipulation

When criminals have a large amount of cash to launder, they often make decisions that are not entirely profit-motivated. These decisions are mediated by the difficulty they face in laundering their money. They might pay above-market prices for goods when they obtain other benefits, like a seller willing not to ask difficult questions about the source of funds for things like cars, jewellery, or even real estate.

For instance, if several money launderers or criminals operate in a region (say, entirely at random, British Columbia), they might find real estate attractive as an investment and method to launder funds. When a lot of dirty money is invested in a regional real estate market, it can create a wedge between local incomes and local real estate prices. The criminals pay more than the fair market value for a property because characteristics of the market (maybe banks, mortgage brokers, and real estate agents who aren’t looking to confirm the source of funds) create benefits for them beyond simply owning the property: they get the property, but they also get an asset they can use to explain their wealth.

In a few years (or months), the criminals might sell the property, then their source of funds becomes “real estate investing”.

In some cases, they might sell the property to other criminals for an above-market value (again, because of the benefits I described above), making a profit and enabling other criminals to enter this market. To some extent, this hypothetical scenario creates a pyramid or ponzi scheme: sustaining the inflated market requires an ongoing supply of new investors paying these high prices. Unfortunately, demand for houses is inelastic in many markets, meaning these prices stay high. Any regular person trying to enter the market now has to pay these new, inflated prices and hope there isn’t a market correction. The money launderers can take the hit from a correction, but can retail investors or families? Probably not.

Unfair Competition

Money launderers don’t just invest in real estate; they seek any asset that can hold (or appreciate) in value. They’re also looking for investments that can be used to explain large quantities of cash. For instance, coffee shops, bars, restaurants, and laundromats are all valuable places to park illicit cash. Not only can you get access to a real, tangible asset (which might be helpful as collateral for loans for other legitimate business ventures), but you get access to a business that generates a large volume of cash. Simply inflating sales can be enough to hide an influx of illicit cash: instead of reporting the sale of $2,000 worth of coffee one morning, money launderers might report the sale of $3,000 worth of coffee, stuffing $1,000 worth of cash into the register and calling it “sales.” For one day, this might not be that helpful. But if you did the same thing every day across multiple locations, you might have a successful method of laundering money. For scams and other types of crime, the internet and cryptocurrency have supercharged money laundering activity.

And what about the people on the same street who are operating coffee shops that aren’t money laundering fronts? They might have a hard time competing with the lower prices of these establishments because to do the kind of volume that the fronts want to do, they will probably have slightly lower-than-market-rate prices. The fronts aren’t worried about making rent; they’re worried about creating a plausible front to move cash. Anyone who has ever operated a business can understand how this activity can create unfair competition.

Undermining Trust in Financial Institutions

We’ve probably all heard the story of TD Bank. In the US, the bank was fined US$3 billion after pleading guilty to money laundering. At least one of the schemes involved 5 employees laundering drug proceeds. TD Bank has basically become a punch line for jokes about money laundering in Canada and the US. While the direct effects of this are difficult to measure (I have yet to hear of many Canadians moving their money out of TD because of a lack of trust), if the problem becomes more systemic, citizens will stop holding cash and assets in their domestic financial institutions. This, in turn, reduces those institutions’ ability to issue mortgages and other forms of credit.

Economic Distortion

Money laundering distorts economies by injecting large volumes of illicit funds into legitimate financial systems, often fueling artificial growth. As these illicit investments inflate economic indicators, there is reduced political and institutional incentive to address the underlying criminal activity. (For instance, this might be the case in some countries’ financial and real estate sectors.) However, this false growth crowds out legitimate enterprises, distorts market competition, and undermines long-term economic stability. Over time, such distortion attracts further illicit activity, entrenching criminal networks and increasing the likelihood of violence as these groups seek to protect their interests and expand their influence. The result is a warped economy where crime thrives, accountability weakens, and legitimate development is compromised.

Reputational Damage Turns Concrete

Some of you might still be thinking, “So what”? If there’s money to be made, it can’t be all bad, right? Well, you’d be right until you’re wrong. See, there’s this little thing called the Financial Action Task Force and international sanctions. States might apply sanctions to countries with serious criminal and illicit finance problems. For instance, the US designates some countries as jurisdictions of primary money laundering concern and, in exceptional cases, can prohibit US financial institutions from transacting with the jurisdiction. Being cut off from the US financial system seriously affects business and individual investors. And the Financial Action Task Force can place countries on its grey or black list. While this is not a direct sanction, in practical terms, being placed on the grey list reduces foreign direct investment and increases friction for individuals doing business internationally by reducing correspondent banking relationships and transaction speed. When countries are placed on the blacklist, they can effectively lose access to entire markets like the European Union and North America.

Crime in Canada

The unfortunate problem in Canada is that there has been an increase in profit-motivated crime over the last decade. Police-reported cybercrime, as well as police-reported organized crime in Canada, have all increased dramatically.1 Some of that increase is visible in information released by FINTRAC. Since 2001, FINTRAC has shared over 20,200 disclosures that it found relevant to a money laundering investigation. I’ve argued here before that FINTRAC disclosures are a very rough indicator of criminal activity in Canada (and we shouldn’t expect a 1:1 relationship between disclosures and prosecutions). However, some estimates suggest that Canada has a $50 billion money laundering problem (or roughly 2.4% of our GDP). Similarly, FINTRAC indicated that it disclosed $44 billion worth of transactions that it suspects are related to money laundering last year. This, along with other qualitative information about the prevalence and role of professional money launderers, suggests that Canada has a growing, not diminishing, problem with money laundering and crime. And increasingly, that is going to cost you and me money and, ultimately, our safety and security.

What we can do

Look, investigating and prosecuting money laundering is hard. I do a lot of work explaining why that is (and why it’s especially hard in Canada). I don’t have time to go into all of the reasons right now (but let me know if you want a separate article on that. I might write it.) Let me assure you that policy solutions exist. However, the thing that has to happen to make policies a reality is public pressure. Right now, political parties have almost no incentive to address the situation. They’re enjoying the benefits of illicit finance being invested in our economy and hoping someone else will be in power when our chickens come home to roost.

But I care about this, and I think you should too. I don’t want more crime in Canada, and I certainly don’t want criminals profiting from me, taking money from my investments or retirement, and generally making me poorer. Imagine if we could tax some or all of that money. I’d certainly take a 10% cut of $50 billion. It might even help buy us some fighter jets or something.

The good news is this: if money laundering is a $50 billion problem in Canada, the solution isn’t investing $50 billion in law enforcement (and related initiatives). I’m not even sure that it’s a $1 billion investment. Even a hundred million would probably yield a good return in reducing crime, seized assets, deterring professional money launderers from setting up shop, and maybe slowly unravelling some of the market-distorting effects that might have happened in Canada.

So when an election candidate comes to your door and says they want to make the housing market more affordable, ask them what they’re doing about money laundering. And when they say they want to be tough on crime, ask them what they’re doing about money laundering. And when they say they want to support small businesses and grow Canada’s economy, ask them what they’re doing about money laundering.

Investing in our ability to combat money laundering comes at a price I’d happily pay. What about you?

Share

In response to all of this tariffs and duty talk, there’s been a push to “buy Canadian”, or at least not American.

(Personally, I prefer an “avoid American” policy because buying Canadian is protectionist, which is precisely what Trump’s tariffs are as well. But honestly, let’s all just do what we can here. And there will certainly be stuff that we can’t stop buying, and that’s okay too. And for my American readers and friends: this is difficult times, and we’re all just doing the best we can in a tough and unfair circumstance. I look forward to re-engaging with US businesses when all this is over, and I hope that’s soon.)

I’ve seen a lot of “Canadian” companies touted as good options. For instance, I saw one social media post suggesting people buy from MEC. Yes, MEC used to be a Canadian co-op, but it’s now Mountain Equipment Company, and is owned by a US investment fund. So how do you know what companies are Canadian and which ones aren’t? Here are a few tools to help you figure it out:

1. Basic web search. (Don’t use Google). Google has been enshitified recently, so you won’t get good results. I suggest using a search engine like Duck Duck Go. You can simply type in the name of the company and ownership and see if there are any news articles about it. If that doesn’t work, you have to get into more detail.

2. Public or private? You will need to determine if the company is publicly or privately held. If the company is a publicly traded company, then ownership is disclosed. You can use tools like Yahoo Finance to determine ownership. If it’s traded on the US or Canadian stock markets, it’s a public company. For instance, if we use Yahoo Finance to determine Shopify ownership, we learn that almost 72% of shares are held by institutional investors (like banks, pension funds, etc).

3. Corporate records. Many companies disclose ownership in their corporate records / statements. You can also look in corporate databases. In Canada, companies can be registered either federally or provincially. For instance, Shopify is registered federally. You can access their info using this link: https://ised-isde.canada.ca/site/corporations-canada/en and searching for Shopify. There, we learn that their registered address is in Ottawa on O’Connor Street. You can also order copies of corporate documents, revealing more details. (Some examples that I’ve done for this newsletter are here.) For a company that isn’t publicly traded, this is where you can find ownership. For instance, if you search for my company (Insight Threat Intelligence), you’ll find out that I’m the sole director of the corporation. In Ontario, you can find similar information, but it’ll cost you a bit of money to order the documents. Perhaps a subreddit would be a great place to start compiling this information so we don’t all do these searches? The actual searchability of these provincial registries varies by province, so it’s a bit hit or miss. (This is part of the discussion around beneficial ownership and illicit finance that I’ve been banging on about for years!)

4. Identifying the name. In some cases, the operating name is different from the registered (legal) name of the company. You’ll often see a company “operating as”. You can usually find the legal name of the company in corporate documents. If that’s not an option, you can also email the company and see if they’ll tell you. If they’re super dodgy about it, that’s interesting…..and you should message me about that. For instance, I searched for my local coffee shop in the Ontario registry, and found out that the cafe was registered by a numbered federal company, so I searched that company in the federal database and found the ultimate owner, and their home address since that’s the registered address for the business.)

In some cases, you’ll have to make your own determination of what constitutes a Canadian company. Is a company owned primarily by Canadians “Canadian”? Is it enough for it to be domiciled in Canada? There’s honestly a bit of a judgement call around some of this stuff, but hopefully these tools can get you started in equipping yourself with knowledge. Don’t just assume that a company that markets itself as Canadian actually is.

It’s also worth considering how your money gets used and what your end goal in a “Buy Canada” action is. In the case of Mountain Equipment Company, it almost exclusively (or exclusively?) operates in Canada, employing Canadians, but profits go to a US investment fund. Is that Canadian? Boycotting it would impact Canadians and their jobs, but profits are not kept here in Canada. This is where judgement calls have to be made.

Anyway, this is quick and dirty. There’s plenty more to learn about this stuff (I teach entire courses on this!) but this should be enough to get folks started to understand what is, and what is not, a Canadian company.

Happy hunting, and be sure to let me know if you find anything surprising!

Share

Financial Intelligence Fundamentals

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! This course is perfect for people new to financial intelligence and seasoned professionals. Enroll today

© 2025 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

FINTRAC, in brief

FINTRAC (the Financial Transactions Reports Analysis Centre of Canada) is Canada’s financial intelligence unit. These units are responsible for receiving and disseminating financial intelligence reported to them from banks, money service businesses, cryptocurrency exchanges, real estate brokerages, and more.

FINTRAC receives a number of “threshold” reports (reports sent to the Centre automatically) of transactions of CA$10,000 or more. This includes reports on large cash transactions, electronic funds transfers (wire transfers), and cross-border currency movements. FINTRAC also receives suspicious transaction reports about suspected money laundering, terrorist financing, and, as of this year, sanctions evasion.

There are different types of financial intelligence units, and Canada’s FINTRAC is an administrative unit: this means that FINTRAC does not conduct investigations. Instead, FINTRAC provides transactions (and some context and analysis) to law enforcement and security services, contributing financial intelligence to their investigations. It’s fair to say that FINTRAC has a finger in almost every law enforcement and security service investigation in Canada.

To learn more about FINTRAC, have a read of the three articles below:

Sanctions Evasion

This year, FINTRAC started to receive suspicious transaction reports relating to sanctions evasion. Prior to this, the Centre was limited to receiving only reports relating to suspected money laundering and terrorist financing. While some sanctions evasion involves money laundering, not all do, so there was a gap in what was reportable to FINTRAC.

While this update only came into force this summer (2024), FINTRAC could disclose information to Global Affairs Canada since last summer (2023). These disclosures relate to the Special Economic Measures Act or the Justice for Victims of Corrupt Foreign Officials Act and related sanctions. This year, FINTRAC sent Global Affairs Canada a single disclosure.

Questions still need to be answered about the utility of these disclosures for GAC, given their limitations on using Canadian information and targeting Canadians for sanctions, since FINTRAC’s data is skews heavily Canadian.

Disclosing the Value of Transactions

In recent years, FINTRAC has come under scrutiny for receiving a LOT of reports but disclosing very few. (For instance: this year, FINTRAC received nearly 49 million transaction reports, and disclosed 966,705, or 2% .) This was one of the criticisms levied at the organization during the Cullen Commission. (You can read what I thought about that here.) In response, FINTRAC has been updating its reporting, and this year, they have included a new table, reproduced below.

This table indicates that FINTRAC has shared a total of 966,705 transactions in 1783 unique disclosures. This is an average of 542 transactions in each disclosure. In total, the value of all transactions disclosed by FINTRAC this year was a whopping nearly $44 billion. That’s $44 billion of transactions that FINTRAC had reasonable grounds to suspect would be relevant to money laundering, terrorist financing, or threats to the security of Canada investigation.

That seems like a lot of dirty money.

Now, to nuance this a bit. First, there is the possibility that some of these transactions have been disclosed multiple times. For instance, a Hizballah financier who is also involved in procuring dual-use technology for Iran and running an illicit money service business in Canada might have their transactions disclosed as possible money laundering, terrorist financing, and sanctions evasion, and those transactions might be included in unique disclosures to three or more different organizations. I asked FINTRAC about this, and they indicated it is possible but rare. Some double-counting might happen in these totals, but it is not enough to shift the scope and scale of the money disclosed.

Secondly, it’s important to remember that these are transactions relevant to investigations of money laundering, terrorist financing, or threats to the security of Canada. That does not necessarily mean these transactions are any of those things. For instance, a terrorism suspect might have all his or her transactions FINTRAC received disclosed to CSIS or the RCMP, but it’s possible that only one or two of those transactions were actually intended for terrorist financing purposes. But all the transactions were relevant to the investigation, so they were all disclosed. Clear?

I think the $44 billion number overstates (possibly by quite a lot) the amount of “dirty” money actually present in those disclosures. I took issue with how similar numbers were represented in a recent op-ed, and you can read some of my reasoning here. However, I also think this might understate the amount of “dirty” money in Canada. FINTRAC only sees a portion of illicit transactions (domestic transactions aren’t reported to FINTRAC unless they’re deemed suspicious, for example), plus, lots of money laundering techniques try to limit what FINTRAC can see. Ultimately, I think we have to be careful about how we characterize these numbers (my clickbait heading notwithstanding) and why a deep understanding of what FINTRAC actually does (and sees) is essential when talking about dirty money in Canada.

For context: If these transactions were contributing to Canada’s economy, illicit finance would probably be in the top twenty sectors contributing to Canada’s GDP.

Terrorist Financing, Money Laundering, and Threats to the Security of Canada

For the first 22 years of its existence, FINTRAC published statistics on the number of disclosures it provided to partners and how those disclosures were categorized (money laundering, terrorist financing, and threats to the security of Canada, or a combination of all three). Then, last year, FINTRAC stopped providing this information in its annual report. I took issue with that then, and I still think this is a big blow to transparency. Not only do these categorizations provide context to the work that FINTRAC is doing, but they are also an important mechanism for holding the RCMP accountable for its responsibilities in investigating terrorist financing, money laundering, and sanctions evasion. We can look at these numbers and ask the RCMP: what are you folks up to? (Hint: the number of money laundering and terrorist financing arrests is not remotely correlated to the number of disclosures the RCMP receives from FINTRAC on these issues.)

Anyway, despite not being provided in the annual report, the folks at FINTRAC were good enough to provide them to me (as they did last year)1. In the chart below, the number of disclosures relating to terrorist financing or threats to the security of Canada steadily increased until 2016-2017, then began a decline. The main pandemic year, 2020-2021, shows the lowest level of these types of disclosures since 2012-2013. Over the last ten years, there has been a statistically significant decrease in the number of terrorist financing and threats disclosures.

There are a number of possible reasons for this. It’s possible that threat actors are using Canada less to conduct their activities, resulting in a decline in reporting from banks and other institutions to FINTRAC and a corresponding decrease in disclosures. It’s also possible that threat actors have gotten better at hiding their activities from reporting entities and FINTRAC and have adopted financial tradecraft to avoid FINTRAC reporting requirements. It’s also possible that FINTRAC has deprioritized terrorist and threat financing disclosures, although, based on my experience working there, I don’t think this is the case. FINTRAC might have also changed how it goes about sharing this information, and instead of providing quick, small disclosures, it provides fewer but more comprehensive disclosures. Finally, it’s also possible that banks and other reporting entities (and FINTRAC itself) are less well-adapted to the current threat environment and less able to detect and disclose terrorist and threat financing activities relating to foreign interference, ideologically-motivated violent extremism and other contemporary threats.

This decline in disclosures relating to terrorism and threats to the security of Canada is surprising, given that reports received by FINTRAC are at an all-time high, as are suspicious transaction reports, illustrated in the figures below.

In my experience, changes in data like this are usually driven by several factors, not just one driver.

The Looming FATF Review

Next year, FATF will start its mutual evaluation of Canada using a new methodology to assess compliance with its recommendations. As part of this methodology, emphasis will be placed on countries posing more significant risks to the international financial systems. Countries prioritized for active review are a) FATF members, b) a high-income country, or c) a country with financial sector assets above US$10 billion. If you’re wondering, Canada fits all three criteria.

The big question is whether Canada will have strategic deficiencies in its ability to counter money laundering, terrorist financing, and proliferation financing. By 2021 (after the initial 2016 review), Canada was found to be compliant or largely compliant across most of the FATF’s recommendations. However, Canada was only partially compliant on recommendations 8, 22, 24, 28, and 29, and non-compliant on recommendation 25.

Whether Canada gets as good a rating as the last follow-up report remains to be seen. FATF is likely looking for progress along many measurable outcomes, and it’s not clear that Canada has made much progress in the last eight years. We’re still waiting for our beneficial ownership registry to come online, for our foreign agent registry, and for the Financial Crimes Agency (remember that?), to say nothing of our dismal prosecution numbers.

At this point, I doubt that FATF will place Canada on the “grey” list for enhanced monitoring, but the new President might be interested in making an example of a G7 country. And if that’s the case, there’s a non-zero chance that example could be Canada. More likely, however, is that Canada is subject to frequent follow-up reports. The folks participating in the mutual evaluation will have a tough hill to climb to demonstrate compliance with FATF recommendations and the effectiveness of Canada’s regime. I wish them all the luck in the world because being grey-listed by FATF would be an absolute catastrophe for Canada’s reputation and economy, particularly with all the global volatility. However, the real travesty is that Canada has not done more to combat illicit finance over the last decade.

Share

Want to learn more about terrorist financing and how to analyze it?

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today and lock in 2024 pricing!

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

ITAC is one of the institutions in place to facilitate the timely dissemination of intelligence assessments before terrorist threats are actioned. However, there is limited and sometimes contradictory information on the organization. Stephanie Carvin’s chapter in Top Secret Canada: Understanding the Canadian Intelligence and National Security Community is one of the few comprehensive sources on ITAC.

Subscribe now

Image created by OpenAI’s DallE

Mandate

ITAC is “a federal organization responsible for assessing terrorism threats to Canada and Canadian interests worldwide.”

ITAC’s stated operations are comprised of:

1. Producing terrorism threat assessments for Canada and Canadian interests worldwide, based on classified and open-source information;

2. Assessing and recommending the National Terrorism Threat Level (NTTL) for Canada, used by government and law enforcement agencies; and

3. Assessing and setting terrorism threat levels for special events like the Olympics and internationally protected persons.

ITAC is solely an assessment body with no collection authorities; instead, it relies on intelligence from other agencies, including CSIS. Classified ITAC assessments are distributed to federal agencies, while unclassified versions are shared with external partners, including certain law enforcement agencies. Unclassified ITAC assessments are sometimes released publicly through access to information requests.

History

ITAC was established in 2004 following the 9/11 attacks in the US and as part of the first and only Government of Canada National Security Strategy. ITAC was initially named the Integrated Threat Assessment Centre. Canada followed the lead of allies like the US, the UK, and Australia, who adopted organizations with integrated models for threat assessment. These centres combine intelligence from various government sectors to provide timely, comprehensive threat assessments.

ITAC's creation aimed to enhance Canada's capacity to protect its citizens and contribute to international security efforts by facilitating the integration of intelligence, ensuring that threat-related information is comprehensive and effectively shared across public and private entities for better decision-making.  The centre was renamed in 2011 to focus specifically on terrorism threats and emphasize supporting the decision-making of senior federal leaders.

Organizational Structure

The centre operates under the Canadian Security Intelligence Service (CSIS) Act and is co-located with the Service, although it functions as a separate intelligence analysis body and maintains operational independence. ITAC employs professionals from various agencies such as the Canada Border Services Agency (CBSA), CSIS, the Department of National Defence, Global Affairs Canada, FINTRAC, and the Royal Canadian Mounted Police (RCMP), through secondment assignments. It also has a permanent analytical and managerial staff to help facilitate continuity and expertise within the organization.  

ITAC is managed by its own director, who is appointed by the National Security and Intelligence Advisor (NSIA). The director is held accountable to the CSIS director, the NSIA, and deputy ministers from participating organizations. Additionally, ITAC is required to submit an annual report to the Deputy Ministers’ Committee on National Security. Furthermore, the National Security and Intelligence Review Agency (NSIRA) and the National Security and Intelligence Committee of Parliamentarians have the authority to review the centre’s activities.

Additional details about ITAC as an organization, including the number of employees and its annual budget, have not been made public.

Organizational Value

ITAC’s primary value lies in its ability to facilitate intelligence sharing and analysis among Canadian security partners like CSIS, RCMP, CBSA, and international partners like the US, UK, Australia and New Zealand. This collaboration helps create a more comprehensive threat picture by integrating diverse perspectives and information sources. The secondment employment model further allows for a multi-disciplinary approach to incorporate analysis from several different security angles.

Another key benefit of ITAC is its centralized and specialized approach to terrorism threat assessments. By focusing exclusively on terrorism threats, ITAC produces comprehensive assessments for Canada and Canadian interests worldwide, leveraging expertise and information from various security agencies. The assessments produced by ITAC directly inform and recommend the NTTL for Canada. This guidance helps government and law enforcement agencies implement consistent security measures and effectively mitigate threats. Moreover, ITAC supports decision-making at senior levels by providing tailored intelligence products, ranging from tactical reports to strategic analyses. These insights assist federal leaders as well as law enforcement to make informed decisions regarding terrorism threats.

Criticisms

ITAC has faced criticism, one major concern being the lack of transparency and public accountability. While ITAC operates under the CSIS Act and is accountable to review bodies, there is limited public information about its operations, threat assessments, and decision-making processes. This opacity has led to criticisms regarding the ability to assess its effectiveness and the adequacy of public accountability.

Another issue is the potential for operational overreach. Although ITAC's mandate is to focus solely on terrorism threats, there are concerns regarding interpretations of what terrorism means. The scope of ITAC’s activities could therefore expand beyond its intended focus. For instance, in 2011, ITAC monitored the potential for politically motivated violence during the ‘Occupy’ protests in Canada, producing reports that activists criticized as anti-democratic and unnecessarily amplifying security concerns about citizen protests.

Furthermore, ITAC’s reputation for analysis has been questioned. The main criticism stems from the unclear value of the NTTL, which ITAC has been responsible for setting since October 2014. The threat level, which has remained at "medium" since its inception, is meant to inform the public and various security stakeholders but requires no action from citizens. This broad, non-specific warning might not provide enough actionable information for local authorities, leading it to potentially being disregarded. National threat warnings often lack the local specificity necessary for effective action, especially in a country as large and diverse as Canada.

Intelligence should be disseminated to those best positioned to use it effectively, but it is unclear if this is consistently achieved with ITAC. The Public Inquiry into the 2022 Public Order Emergency found that there were free-standing intelligence reports from multiple federal, provincial, and municipal governments and police agencies, with products not always being shared effectively or reaching the appropriate audiences. ITAC, as with many other agencies, likely suffers from ineffective and heavily red-taped information dissemination practices, hindering its ability to be proactive.

ITAC's reliance on temporary staff assignments from various agencies, rather than a dedicated, permanent workforce, also raises efficacy concerns. The rotational model might affect continuity, retention of institutional knowledge, and the long-term expertise of its analysts, leading to additional criticism regarding ITAC’s analytical capabilities.

Opportunities for Improvement

Overall, ITAC has the potential to play a crucial role in Canada’s national security by facilitating intelligence assessment and sharing. However, criticisms point to areas where its operations and transparency could be improved to enhance public trust and effectiveness. A review by NSIRA or NSICOP could be valuable in this regard. Such a review should examine ITAC's organizational and operational practices, as well as the net benefits of its products. Increasing transparency about the outcomes of this review, where feasible, would help demonstrate the organization’s value and identify areas for improvement.

Did you find this post insightful? Share it with a colleague!

Share

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

~Jess

Establishing a baseline

Since 2018, I’ve captured terrorist financing “cases” from media reports, court cases, government press releases, and other open sources. These are incidents of terrorist financing that refer to operational or organizational financing. In each case, we look for financing attributes, such as the methods and mechanisms involved in raising, using, moving, storing, managing, and obscuring funds. This builds on the data and analysis from my 2021 book Illicit Money.

Over the last six years, I’ve identified 618 terrorist financing cases that are now included in this dataset. As you can see in the graph below, data collection in 2018 and 2019 was still spotty. We instituted new data collection practices in 2020, so things took off then, and the data is robust from 2020 onwards.

There is an apparent dip in terrorist financing cases in 2021 and 2022. This is interesting because it mirrors a similar dip in FINTRAC terrorist financing disclosures that we attribute to the pandemic. Or was there just less terrorist financing? Or less reporting on it? Many intervening factors are likely to explain this, but it is interesting to see global terrorist financing cases largely mirror FINTRAC disclosure trends.

Share

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing and analyze suspicious patterns and activities more effectively. Sign up today!

New trends

Read more

Updated August 2024

Espionage is the act of collecting secret information, usually through illegal means. It often involves state actors who use spies, agents, and technology to acquire secrets against target countries (or, in some cases, private sector assets). Espionage financing refers to the ways that espionage activities are financed. This can include the amounts of money paid for secrets, how the funds were transferred, how the technologies used for espionage are funded and developed, and even how the money was raised in the first place. This article provides an update on recent events in the espionage finance world and contextualizes it within the broader landscape of illicit finance.

Relatedly, foreign influence or foreign interference is how states deploy spies, agents, or even regular citizens to influence a country’s policies and politics in their favour or interfere in the normal course of politics or life in a country. While just as serious, foreign interference/influence financing looks a bit different from espionage financing, so we’ll deal with that threat in another issue of Insight Monitor.

Espionage requires money, which is often provided through state budgets via embassies, electronic funds transfers, or cash. However, we are increasingly seeing espionage activities undertaken and financed through cryptocurrencies.

No country is immune to espionage, and individuals in sensitive positions provide information for a variety of reasons, but most of all for financial need. On average, espionage cases involve payments of around $480,000, but there’s a lot of variation: in some cases, perpetrators of espionage were paid as little as $25,000 for the information or access they shared, while in other cases, perpetrators were paid as much as $2 million.

Do you want to learn more about financial intelligence and how to use it in research, investigations, and analysis? Our financial intelligence fundamentals course is for you! Launching 2 July 2024, this course is perfect for people new to financial intelligence and seasoned professionals. Enroll today!

Canadian Cases

On the lower end of this spectrum was one of the most recent espionage cases in Canada: Cameron Ortis. He was convicted of security of Information Act offences for transmitting classified information to a criminal organization and offered to provide full documents for $20,000. (As far as we know, no money was actually transmitted.)

Somehwere in the middle of the spectrum of espionage payments is Jeffrey Delisle, a Canadian sailor convicted of spying for Russia. He was also paid in cash, prepaid cards, and by transfers from Russia, which occurred between 2007 and 2011. He might have received as much as $144,000 or possibly more.

On the other end of the spectrum is the case of a Canadian doctor who is alleged to have been part of China’s Thousand Talents Program. Dr. Qiu worked at the National Microbiology Lab in Winnipeg and had an employment agreement with Hebei Medical University. She was compensated with funding of approximately CAD$1.2 million for science and research and was personally compensated CAD$ 15,000 per month and an additional $30,000 for leading laboratory operations when offside. Dr. Qiu and her husband had undisclosed bank accounts in China’s Commercial Bank. In total, she was likely paid at least $210,000 (on top of her Canadian government salary and research funding), and possibly much more, for sharing information with Chinese research institutes.

Sometimes, no money appears to change hands. In 2022, Yuesheng Wang was arrested by the RCMP and charged with economic espionage under the Security of Information Act. He faces three charges under the criminal code as well and is alleged to have given sensitive research and corporate information to a Chinese university and Chinese research centres, published scientific articles and filed patents with them. To date, there has been no information released about what, if any, financial compensation he received.

US Cases

Many cases of espionage in the US and plenty involve payment for services and information. For instance, an FBI official recently pled guilty to offences related to services he provided to Russian oligarch Oleg Deripaska to investigate a rival Russian oligarch and hid $225,000 in payments from an Albanian agent while still working for the FBI. In another case, Sgt. Korbein Shultz was arrested for providing sensitive security records in exchange for $42,000 to a contact believed to be living in Hong Kong. He appears to have been motivated by financial concerns and pled guilty to selling sensitive information in August 2024.

In 2018, a former CIA officer was indicted on a charge of conspiring to commit espionage. Jerry Chun Shing Lee was approached by two Chinese intelligence officers who offered to pay him for information. The intelligence officers provided Lee with a series of email addresses through which they would communicate. The information Lee provided is believed to have helped China unravel the CIA's spy network in the country. Reports provide little insight into how much, or how, Lee was paid for the information he provided, although he 'made numerous unexplained cash deposits'’, which could potentially have been cash payments for his services.

In 2021, a Harvard professor was found guilty of concealing his ties to China and is alleged to have contributed to Chinese economic espionage. Lieber worked as part of China’s Thousand Talents Program and was paid hundreds of thousands of dollars. He was paid as much as $50,000 per month, $150,000 in living expenses, and $1.5 million in research grants. He received half of this money in US dollars, and the other half was deposited into Chinese bank accounts. (This case is remarkably similar to the case in Canada described above.)

In another case (from 2019), CIA Case Officer Kevin Patrick Mallory sold classified documents to Chinese intelligence for $25,000. He was motivated to sell the secrets because of debt and being behind on his mortgage. After a trip to the PRC, he had $16,500 in cash.

Also in 2019, former DIA officer Ron Rockwell Hansen pleaded guilty to transmitting information to the PRC. He received as much as $800,000 over several years for the secrets he provided. He often carried cash into the US after his trips abroad.

Espionage and Cryptocurrency

While cash is still an important part of espionage financing, cryptocurrency is increasingly prominent (in line with broader trends in illicit finance). In a 2021 case, a US navy employee and his wife are alleged to have tried to sell secrets about US nuclear submarines to a foreign country (some suggest this was likely France). The engineer allegedly asked for US$100,000 in cryptocurrency and, over the course of an undercover operation by the FBI, received payments of $10,000, $20,000, and $70,000. The payments were made using Monero. The couple were interested in selling their secrets for $5 million.

This method of paying sources/spies can be anonymous(ish), fast, relatively secure, and, when combined with other financing methods, can be effective for obscuring (or severing) the money trail. However, other methods of paying espionage networks remain common, including cash. In fact, money appears to be one of the main motivating factors for modern espionage, so understanding the financial trail is critical for detecting and disrupting these networks.

Cash Payments Still Reign

Historically, cash has been the primary means of paying spies and foreign actors and remains a key component of espionage financing. More recently, two arrests in Germany in 2021 of individuals suspected of spying for Russia also involved cash payments.

A German intelligence officer is also on trial for high treason, suspected of espionage for Russia and providing classified information to Russian agents. Each man in the plot was compensated at least $400,000 Euros, paid in cash.

Tradecraft Issues with Cash Payments

Obscuring the money trail is important for spies who want to remain anonymous or have their activities be unattributable. Paying spies in cash also creates an issue—the individuals involved in the espionage activity have to figure out what to do with the cash and risk being exposed by anti-money laundering programs. For instance, a number of the cases detailed above involved cash payments of thousands of dollars. To use this money, the individuals involved would either have to pay for a lot of goods and services in cash (something that tends to raise alarm bells in an increasingly cashless society), or “place” the money into the financial system, which again, can raise alarm bells.

Funding Espionage Activities

Espionage isn’t free, and even well-funded intelligence organizations have reasons to fund their activities outside of the official budget, like removing oversight or further hiding their activities from adversary countries.

Russia is one country that has done this, including through the formal financial system. In 2013, Danske Bank was made aware of potential money laundering through its branch in Estonia. The whistleblower report suggested that the bank was being used by Putin's family and a group of accused money launderers to launder funds and that the Russian Intelligence Service, the FSB, was also using it for the same purpose. The bank may also have been used in sanctions evasion. Danske Bank is now examining a further $150 billion in transactions received between 2007 and 2015.

Sometimes, a cover can also be a source of funds. For instance, a Canberra cafe that serves Australia’s top spies, federal police, and intelligence officials was found to be co-owned by a Chinese politician honoured by Xi Jinping for work advancing the Chinese Communist Party’s ambitions at home and abroad. This cafe might have generated profits, while also serving as a front for intelligence collection.

And in Zimbabwe, the state’s Central Intelligence Organization enagages in private business as a source of off-budget financing. This includes mushroom farming, exporting baby elephants, and diamond mining. One entity involved is Terrestrial Holdings, a business conglomerate of companies involved in hemp, solar energy, coal mining, tourism, and golf. The funds generated from these business ventures are separate from their official budget, meaning they can fund activities outside the normal budgetary (and oversight) processes.

Detecting espionage financing is just as difficult as detecting other forms of illicit financing, and possibly more so because of a lack of typologies and indicators of espionage financing. While there are a growing number of cases, we are still some distance from having reliable patterns that can be detected in financial transactions. However, these cases do provide important insight for individuals investigating suspected espionage financing: cash, bank transfers, and cryptocurrency transactions are all good places to start looking for the money trail.

Share

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

This primer presents an overview of the common arguments for and against negotiating with terrorists, as well as negotiation best practices. For a look at the effect of paying ransoms for terrorism itself, check out an article that Jessica co-authored in 2022:

What do we mean by negotiation, and who is involved?

Negotiation, fundamentally, is a process of discussion aimed at reaching an agreement. In the realm of counter terrorism, engaging in negotiations with terrorist groups is often equated with governments yielding to their demands. In reality, these discussions can involve a broader set of tactics and actors beyond the state. While typically envisioned scenarios involve governments paying ransoms in response to hostage situations, negotiations can also encompass other forms of objectives and concessions, such as prisoner exchanges or offers of amnesty. Additionally, other parties, including families and businesses, can trigger or influence the outcome of negotiations and are necessary to understand the full scope of the strategy.

Policy Positions of Different States

Many Western nations, including the United States, Canada, and the United Kingdom, officially maintain a policy of not negotiating with terrorists, particularly in hostage situations. This stance was asserted by Canada during the kidnapping of John Ridsdel and Robert Hall by Abu Sayyaf in the Philippines in 2015. After Canada held firm to the policy of non-negotiation and not meeting ransom demands, Ridsdel and Hall were executed. The event was controversial and although it highlighted the consequences of a non-negotiation doctrine, Canada still officially holds the same policies regarding hostage-taking.

Regardless of the official position of states, negotiations still happen regularly. Presently, Israel has ongoing mediated discussions with Hamas on a truce and hostage deal. Historically, the Spanish government has engaged with ETA, the British government with the IRA, and the Taliban alleged that South Korea paid more than $20 million for the freedom of 19 hostages. Despite official statements to the contrary, it was reported that Canadian diplomat Robert Fowler's release from captivity in Niger involved a ransom payment of $1.1 million in 2009. The United States, while generally adhering to a non-negotiation policy, has also faced its own controversies, such as the exchange of five Taliban prisoners for Sergeant Bowe Bergdahl in 2014. These instances highlight that, despite public declarations and posturing, negotiations with terrorists do occur.

In addition to state-level negotiations, there are instances where families and private corporations take matters into their own hands. The case of Canadian Amanda Lindhout in Somalia is one example, where her family raised funds for her release when the government ceased its involvement. Private companies also often pay ransoms for their employees, with a significant number of Fortune 500 companies carrying kidnap and ransom insurance for workers in high-risk areas. This insurance typically activates specialized risk-response teams to handle the situations.

Benefits of Non-Negotiation

Several key arguments advocating for non-negotiation with terrorists and emphasize the potential dangers or counterproductive outcomes. Firstly, paying ransoms offers no assurance of the hostages' safe return and could embolden terrorist groups by creating a lucrative business model out of kidnappings. This not only sets a precedent but could also lead to an increase in such incidents, as terrorists perceive hostage-taking as a successful strategy to extort resources from governments.

Agreeing to terrorists' demands can inadvertently support their operations. The influx of funds from ransoms might sustain a terrorist group’s control over territories, enable them to compensate their members, and finance further terrorist activities and abductions. Such outcomes contribute to the persistence of the groups (although this is contested by Jessica’s recent research).

Negotiating with terrorists might also inadvertently lend legitimacy to the terrorist groups, their objectives, and their methods. It sends a signal that their tactics are effective, potentially inspiring others and lending credibility to their causes from the viewpoints of their supporters. This recognition can lead to an escalation of violence, as negotiations could be exploited by militant factions to buy time to regroup or plan further attacks. Additionally, the process of negotiation can create fractures within terrorist groups, emboldening hardline splinters to perpetuate even more extreme forms of violence to undermine any potential peace efforts.

From a political standpoint, engaging in talks with terrorists can contribute to the destabilization of democratic states. It can shake the confidence in the government, particularly if negotiations are perceived as yielding to the demands of terrorists. This not only undermines the democratic process but also weakens the broader norm of resolving conflicts through non-violent means. International efforts to delegitimize and combat terrorism can be undercut.

Lastly, history has shown that settlements reached through negotiations with terrorist groups are often fragile, leading to a recurrent cycle of violence. The rationale behind a non-negotiation policy is based on the idea of removing any incentive for terrorist organizations to take hostages. By unequivocally denying potential gains from such acts, the aim is to ultimately discourage terrorists from engaging in hostage-taking as a strategy.

Drawbacks to Non-Negotiation

The refusal to negotiate with terrorists has not conclusively deterred the kidnapping of citizens from the United States, the United Kingdom, or Canada, nor has it consistently facilitated their release. Hostage-taking continues, with perpetrators often indifferent to the national policies of their victims' countries of origin. To kidnappers, foreigners can represent potential income and have propaganda value, irrespective of their nation's stance on negotiation.

Internationally, there is a consensus among the global community to deter ransom payments, but adherence to this pact varies, casting doubt on the collective resolve to a strict non-negotiation policy. The practice of negotiating, while publicly denied, occurs under the guise of various pretexts. Germany, for instance, has been reported to have paid a ransom disguised as humanitarian aid to secure the release of hostages in Mali. Similarly, third-party intermediaries are sometimes engaged to conduct negotiations indirectly, sidestepping official policies. This inconsistency highlights the challenges of a unified global approach to terrorism and raises questions about the effectiveness of non-negotiation as a deterrent.

High-ranking officials and diplomats are often prioritized in secretive negotiations, contrary to public statements. Companies with the means to carry ransom insurance tend to secure the release of their employees through private means. Those less protected, such as freelancers and solo travelers, could find themselves at the end of the priority list, relying on their families who face the moral dilemma and legal risks of financing potential terrorist activities.

When negotiations are off the table, governments might resort to military interventions, which carry their own risks and uncertainties. For example, South African Pierre Korkie, who was supposedly in the process of being freed from Al Qaeda after his family reportedly negotiated a ransom deal, was killed along with 9 others during a failed rescue attempt by American forces in 2014.

The assumption that paying ransoms leads to an increase in terrorist attacks isn't as clear-cut as it might seem. In Jessica's article, the research shows a more nuanced picture: while one studied group did experience an uptick in violence correlated with receiving ransoms, for other groups, ransom payments were linked to either a decrease in the number of attacks or a reduction in their severity. This suggests that the effects of ransom payments on terrorist activity are more complicated than the prevailing logic might suggest.

The strict adherence to a non-negotiation stance has negatively impacted the development of best practices for handling similar situations. While the public rhetoric remains firm, the behind-the-scenes actions suggest a need to re-evaluate and potentially establish a more pragmatic and informed approach to negotiating with terrorist groups.

Best Practices for Negotiation

Engagement with terrorist organizations isn't always advantageous and heavily depends on the specifics of each situation. Nevertheless, there are certain considerations that could help increase the chances of positive outcomes in negotiations:

Understanding the Terrorist

The initial best practice involves comprehensive information gathering about the terrorist. This step is crucial to discern whether the group is more ideologically driven or pragmatic in its approach, which can influence their openness to negotiations. For example, organizations like Hamas and Hezbollah, despite their ideologies, have participated in pragmatic political behaviors. They are likely to be better candidates for negotiations than, for example, extremely ideologically driven lone actors. Distinguishing whether the captors are purely politically motivated or also engage in criminal activities for profit is vital, as this influences the strategy and potential incentives offered during negotiations. If hostages are taken for ideological reasons, it could be harder to come to an agreement as the terrorists make no demands and instead consider their actions as purely punitive.

It's also essential to determine if the group has state sponsorship, which can affect their adherence to negotiated agreements. Depending on the relationship between the sponsor and the group, there could be more value in negotiating directly with the state.

Early Engagement and Controlled Implementation

Engaging early with the group is essential, as trust-building is a gradual process that requires time.  Early discussions not only help in understanding the kidnappers' demands and capabilities but also in confirming who actually holds the hostages. This is crucial to ensure negotiations are not misled by external parties falsely claiming involvement. Professional negotiators often advocate for initiating dialogue promptly and managing any necessary ransom payments with extreme caution. This includes using marked bills and conducting surveillance to trace the funds, potentially aiding in a rescue operation or even dismantling a financial network.

Future Outlook

The lucrative nature of kidnapping and hostage-taking, especially as a method to raise funds, means that it is unlikely to stop regardless of any international pact to stop negotiating with terrorists. The practice continues and, in many instances, has resulted in the safe return of hostages. Negotiation, though not universally applicable or morally unambiguous, can sometimes lead to outcomes that align with counter terrorism objectives, including the potential for constructive engagement.

Current trends do not suggest significant shifts in the stances of many Western countries, though Canada might consider policy adjustments to decriminalize ransom payments by families, a point of divergence with the US approach. In the wider context, it is crucial to learn from past mistakes in tactics and to view negotiation as it truly is—an opportunity for two parties to reach a consensus. This perspective shifts the narrative from viewing negotiation and concessions as signs of governmental weakness to recognizing them as strategic tools in conflict resolution.

The impact of negotiations on public opinion remains an area for further exploration. It's important to assess whether public sentiment actually aligns with non-negotiation policies and whether the public understands the potential benefits of negotiating, particularly in terms of sustaining trust in government responses during crises. Furthermore, while media coverage can pressure governments to take action, it can also obscure decision-making during negotiations and potentially escalate conflicts. Additional research into the most effective media management strategies would also valuable. Finally, understanding how negotiation outcomes vary depending on the lead actor—whether it's a state, business, or private entity—could also provide important insights into the general odds and factors of negotiation success.

Negotiation is not an all-encompassing solution and is filled with complexities, such as public dissent and political opposition, which can impede its progress. Therefore, while keeping the negotiation channel open is valuable, it is equally important to recognize the many factors that influence its success. While best practices provide a foundation for negotiation strategies with terrorist groups, they highlight that there is no uniform solution for every scenario. Ultimately, negotiation should remain an option within the counter terrorism toolkit, employed cautiously and with a clear understanding of its potential and limitations.

Did you find this post insightful? Share it with a colleague!

Share

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

However, the dark web also presents opportunities for misuse. This primer explores key reasons terrorists use the dark web, as well as its role in financing terrorist organizations and operations.

Subscribe now

Main Terrorist Uses of the Dark Web

Identity Protection and Secure Communication

One main reason terrorists use the dark web is to protect their identities and evade detection. By leveraging the anonymity mechanisms that the dark web offers, terrorists can explore, purchase, and communicate on websites without the risk of easy detection. For example, in August 2013, the US National Security Agency intercepted encrypted communications between al-Qaeda leader Ayman Al-Zawahiri and Nasir Al-Wuhaysi, the head of Yemen-based al-Qaeda in the Arabian Peninsula. This intercept revealed that al-Qaeda had been using the dark web for regular communication between its leaders worldwide for a decade. That said, secure messaging platforms like Telegram have emerged as more accessible alternatives for terrorists, bypassing the need for the technical knowledge required to navigate the web through the Tor browser.

Propaganda Repository and Presence Mirroring

Another use of the dark web by terrorists is as a repository for propaganda. Unlike surface websites, which are vulnerable to being removed by law enforcement or platform providers, the dark web offers more stability in hosting propaganda materials. For instance, ISIL has turned to the dark web to post news and propaganda. Following the November 2015 attacks in Paris, the hacktivist group ‘Anonymous’ launched an operation that led to the takedown of hundreds of ISIL-associated websites. In response, ISIL's media outlet, Al-Hayat Media Center, pivoted to posting content on the dark web. The group also shared links and guides on an ISIL-associated forum on how to access their new dark website.

Some terrorist organizations regularly post duplicate content on both the surface and dark web to serve as a backup and ensure their online activities can continue even if their main websites are taken down. However, a direct dark web presence among terrorist groups is not overly common. A study tracking 200 terrorist domains found that only 10 had a mirrored presence on the dark web. This suggests that although the dark web is used by terrorist groups for purposes such as securing communication channels and disseminating propaganda, it is not their primary means of establishing an online presence.

Financing Specific Uses

Soliciting Donations Through Cryptocurrency Transactions

Criminals often leverage the anonymity that digital currencies such as Bitcoin, Monero, and other coins offer. These currencies are particularly appealing for conducting transactions on the dark web. Terrorist organizations have recognized this potential and increasingly turned to cryptocurrencies to solicit and receive donations discreetly.

In 2015, IS posted its Bitcoin address on the dark web, allowing sympathizers to send funds directly. The trend continued in November 2017, when the Akhbar al-Muslimin website, known for publishing news from IS, initiated an online fundraising campaign. This campaign explicitly requested donations in Bitcoin, directing supporters to a dedicated donation page on CoinGate, a Bitcoin trading site. Each article on the site was accompanied by a link encouraging donations, with a note advising not to use zakat funds.

Figure: 2015 IS Dark Web Bitcoin Donation Campaign Image

To facilitate the adoption of the dark web as a fundraising platform, specific instructional documents are often disseminated on the surface web. For example, a PDF document entitled “Bitcoin and the Charity of Violent Physical Struggle” was circulated in July 2014. Although the group affiliation of the document is unknown, it provided instructions on using the dark web to financially contribute to a campaign to support Jihad.

There are also anecdotal reports of crowdfunding platforms on the dark web being explored as potential channels for other terrorist groups, potentially from the far-right, to finance their activities. However, concrete details and official information on this aspect remain limited, highlighting the challenges in monitoring and combating the use of digital currencies for illicit fundraising on the dark web.

Sale of Illicit Goods and Services

The dark web is infamous for its marketplaces where illegal goods and services can be bought and sold with a degree of anonymity. Terrorist groups have reportedly exploited the dark web to sell drugs, weapons, human organs, looted antiquities, stolen oil, and even services such as hacking. The marketplaces could also enable terrorist organizations to advertise recruitment incentives, such as salaries and benefits, to attract new members.

In addition to selling or advertising illicit goods, terrorists use the dark web to procure items crucial for their operations, ranging from instructional manuals and fraudulent documents, to firearms and their components. For example, the perpetrator of the 2016 Munich Shooting executed the attack using a weapon purchased from a dark web marketplace. However, the trade in weapons on the dark web is not as common as for electronic products like stolen identities—due largely to the logistical challenges of smuggling physical items. Terrorists have instead shown interest in acquiring blueprints for 3D-printed weapons to circumvent some of the challenges associated with transporting conventional arms.

Although there are instances of terrorists both making sales and purchases on the dark web, it is challenging to verify the associated transactions. An inability to establish the origin of illicit goods sold on the dark web adds another layer of complexity to the challenge of disrupting the activities.

Access to Money Laundering Techniques and Financial Facilitators

The dark web not only facilitates the sale and purchase of illicit goods and services but also acts as a hub for financial crimes, including money laundering. By offering both instructional resources and access to individuals skilled in obscuring the origins of illegally obtained money, the dark web has become a tool for terrorists looking to launder their funds.

One of the primary methods used for money laundering on the dark web involves cryptocurrency mixing and tumbling services. These services anonymize transactions by blending the digital currency of multiple users, making it difficult to trace the funds back to their source. This anonymity is particularly appealing to terrorists seeking to disguise the financial trails of their operations. In early 2023, the US Department of Justice took down ChipMixer, a dark web mixing service that processed over $3 billion in unlawful transactions, some of which could have been tied to terrorist activity.

Additionally, some dark web marketplaces sell fraudulent documentation that can assist criminals in setting up shell companies, which can then be used to funnel illicit funds through seemingly legitimate businesses. Potential terrorist exploitation of the shell company resources complicates law enforcement efforts to track and intercept illicit financing.

Access to stolen identities is another crucial aspect of money laundering facilitated by the dark web. Terrorists can use these identities to create bank accounts or acquire financial products, further obfuscating the movement of funds. This tactic not only aids in laundering money but also contributes to a broader spectrum of financial crimes, including fraud and identity theft. For instance, a Jihadist group in Indonesia used the dark web to solicit donations in Bitcoins from both national and international supporters. After leveraging a stolen identity obtained from the dark web, the group then hacked a foreign exchange. trading site to steal points from a member, ultimately amassing $600,000 for their operations.

Although there is limited evidence available, the dark web could also act as a marketplace for hiring corrupt financial service providers. These individuals or entities could be willing to overlook legal requirements in exchange for compensation, providing services such as unauthorized bank transfers, false accounting, and other methods of laundering funds. Their expertise and willingness to participate in illegal activities would make them valuable for terrorists aiming to integrate their funds into the global financial system without detection.

Responses to Terrorist Use of the Dark Web

Efforts to dismantle terrorist operations on the dark web, such as taking down specific sites, often resemble a "whack-a-mole" exercise—challenging and not necessarily effective in the long run as new replacements inevitably pop up. The Silk Road takedown, for example, highlighted the possibility of disrupting dark web activities but also emphasized the difficulties in eradicating such platforms altogether.

Additionally, while the dark web offers some advantages for terrorist organizations, the lack of regular search capabilities and the technical expertise needed by users can make it less appealing. Terrorists are more inclined to use tools such as VPNs to hide their identities while operating on the surface web, where they can achieve greater visibility and impact. Consequently, counter-terrorism strategies focused more on the surface web, where terrorist propaganda, recruitment, and fundraising efforts have the potential to reach a far wider audience, are likely beneficial.

However, as technology progresses, creating tools and methods to track terrorist activities on the dark web remains necessary. Initiatives such as the Defense Advanced Research Projects Agency's MEMEX program, designed to better index the deep web, and the European law enforcement's DANTE program, which aims to identify and link various online actions to possible terrorist operations and fundraising activities, are important disruption efforts. These initiatives also emphasize the value of conducting further research to better understand and mitigate the terrorist use of the dark web for financing activities.

Did you find this post insightful? Share it with a colleague!

Share

Don’t forget that our Terrorist Financing Analysis eLearning course is open for new enrolments. Learn more about how terrorists use various technologies for financing purposes by signing up today.

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

~Jess

And if you want to learn more about terrorism financing, check out our course. It has everything you need to become an expert in analyzing terrorist financing trends, methods, and issues:

Our terrorist financing analysis course caters to researchers, intelligence, law enforcement, and compliance professionals to help them learn about terrorist financing, and analyze suspicious patterns and activities more effectively. Sign up today!

Share

© 2024 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Share

In November, the province of British Columbia issued its first unexplained wealth order, and the first unexplained wealth order in Canadian history.

The order targets two BC residents, and requires that they explain how they got $1 million to buy a home on Salt Spring Island. The couple are believed to be beneficiaries of a major stock fraud scheme (a pump and dump arrangement involving a Swiss firm that hid the beneficial owners of the companies). One of the subjects of the order bought the home for $1 million cash in 2017, and listed her occupation as “home maker”.

Unexplained Wealth Orders, in Brief

UWOs compel people to explain how they acquired their wealth in cases where there are suspicions that it came from criminal activity. UWOs do not require a criminal conviction in order for assets to be seized. In other jurisdictions, UWOs are sometimes  viewed as an investigative tool to help build evidence for a criminal case, because in responding to the UWOs, individuals might reveal additional information that can be useful for securing a conviction.

UWOs are seen as tools for addressing complex money laundering and professional money laundering networks, and might be particularly useful where there is (and will likely always be) insufficient evidence for a criminal conviction, such as in cases where international crime has occurred and the ability to get evidence is limited.

These orders compel people to explain how they acquired their wealth in cases where there are suspicions that it came from criminal activity. They can also target assets that are used to engage in unlawful activity, and where the property or a portion of the property was acquired or is maintained as a result of unlawful activity.

Use in Canada

In British Columbia, the Civil Forfeiture Act was amended to include legislation to allow for unexplained wealth orders. These orders target  assets of more than $75,000 and are meant to address some of the deficiencies identified in the Cullen Commission.

Manitoba might soon also introduce legislation to create unexplained wealth orders, likely also as part of its civil forfeiture act.

The use of UWOs in Canada are by no means settled law. There are significant civil liberties concerns, particularly whether they undermine the presumption of innocence and if they subvert the rights that shield people from unreasonable search and seizure.

Whatever happens, these orders are likely to end up at the Supreme Court and will almost certainly undergo a challenge under the Canadian Charter of Rights and Freedoms. My view is that these orders are an important tool, but are not a panacea for solving our problems with addressing money laundering, proceeds of crime, and financial crime in general. If they withstand the inevitable charter test, they will likely have to be used sparingly. Canada will need to continue to strengthen our existing financial crime framework and develop new tools for our toolbox to counter adaptive threats.

Our terrorist financing analysis course is open for the next two months. In February, we’re going to close it to new registrations while we do an update, and re-open sometime in mid-2024. So sign up today if this is on your to-do list for 2023 or 2024! All current students maintain access to course content, forever.

© 2023 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

History

The RCMP was formed in 1920 as the Federal police force in Canada, merging two existing police forces with national security and intelligence as part of its mandate. In 1950, the RCMP Special Branch (along with a national security intelligence function) was created. Special Branch was restructured as the Directorate of Security and Intelligence in 1962, then renamed the Security Service in 1970. In 1984,  many intelligence functions were transferred to the civilian Canadian Security Intelligence Service (CSIS).

Subscribe now

Throughout the 1920’s and 1930’s, the primary focus of RCMP intelligence was on Marxist, anarchist,  labour and fascist individuals organizing inside Canada; as part of this policing activity, the RCMP often targeted people based on ethnicity. Following WWII, the RCMP returned to monitoring a broad range of leftist, feminist , labour and Quebec separatist causes from the 1950’s to the 1980’s .

RCMP Intelligence collection regularly violated the law, and after a parliamentary inquiry in 1969 and very public intelligence failures (including burning down a barn) the federal government launched the McDonald Commission in 1981. The Commission recommended the creation of a civilian intelligence agency and many of the RCMP’s existing intelligence staff and undercover agents were transferred to the new CSIS in 1984.

The creation of CSIS did not remove policing functions related to national security from the RCMP. However, it did split responsibilities between CSIS and the RCMP; the resulting intelligence sharing issues created serious limitations, including the failure detect and disrupt the Air India bombing.

Following the September 11th attacks in the United States, the Canadian Parliament expanded antiterrorism legislation and resources for both organizations. This added to the overlap between the RCMP's national security policing mandate and CSIS’s intelligence collection and dissemination mandate. 

 In 2015, the RCMP's intelligence functions were reorganized under the National Intelligence Coordination Centre with the goal of  improved information sharing and cooperation. 

Understanding the history of the RCMP’s colonial policing roots, the abuses of mid-20th-century RCMP intelligence gathering, and the overlap of functions with CSIS helps explain many aspects of the Cameron Ortis trial including the persistent failures of basic management oversight and the lack of standard controls on intelligence material.

RCMP Intelligence

The RCMP’s direction and intelligence priorities are the responsibility of the Parliament of Canada, Parliamentary committees, and the Minister of Public Safety. The Government of Canada’s priorities are set through a five month process that begins with consultations with the intelligence community and concludes with cabinet approval and the issuance of ministerial directives by appropriate ministers.1 Once the agenda has been set, detailed planning is directed by headquarters in Ottawa under the RCMP Commissioner.

The specific laws that authorize the RCMP to act are the Royal Canadian Mounted Police Act, 1985 and other public safety Acts.  Oversight of RCMP intelligence functions comes from the Cabinet Committee on Global Affairs and Public Security and the Standing Committee on Public Safety and National Security Direct supervision of the RCMP comes from the Minister of Public Safety and the RCMP Commissioner

Planning

RCMP national intelligence planning is centralized in Ottawa. The RCMP’s intelligence strategy is outlined for ‘Federal Policing’, which covers national security policing, international policing, financial crime, protective operations, organized crime, & cybercrime. Planning is also done for ‘Specialized Policing Services’, which covers criminal intelligence analysis and sensitive investigations.

The structural split between what the RCMP classifies as ‘Criminal Intelligence’ and ‘National Security Intelligence’ is a key point of ambiguity. The conflict over what is ‘National Security’ and what is ‘Criminal’ is what various scholars and the McDonald Commission report  identify as an example of the politicization of RCMP policing powers. 

Collection

Collection of national security intelligence using signals intelligence against foreign nationals is the responsibility of the Communications Security Establishment (CSE); intelligence from certain human sources is the responsibility of CSIS. The RCMP also collects criminal intelligence information, acts as an information broker between police forces within Canada, and collaborates with foreign police services / INTERPOL on prosecuting international criminal networks. The RCMP collects some human source criminal intelligence, but the distinction is ambiguous and can overlap with national security intelligence collection. 

For domestic and transnational organized crime, the RCMP maintains the Criminal Intelligence Service Canada (CISC) and for cybercrime the National Cybercrime Coordination Centre (NC3). Some areas of concern with RCMP intelligence collection is the use of technologies like cell site simulators and undercover agents who use entrapment.

Analysis

Through the CISC and N3, the RCMP analyzes intelligence to produce intelligence briefs. National Security intelligence generally flows from CSE and CSIS to the RCMP through Strategic Case Management (SCM) and Tactical Deconfliction (TD), processes that can involve meetings or written communication called Use Letters. 

The National Intelligence Coordination Centre (NICC), located in RCMP headquarters, acts as a central information sharing location between CSIS, CSE, Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), the Five Eyes (a formal intelligence sharing agreement between Canada, the United States, the United Kingdom, Australia and New Zealand ), and RCMP leadership. The prosecution of the former director of the NICC, Cameron Ortis, is providing insight into what is usually a highly secretive analysis process.

Within the NICC , Operations Research was set up to integrate information to inform strategic and tactical responses by the RCMP. The NICC has broad access to operational RCMP case files, provincial police agency information, intelligence provided by Canadian intelligence agencies, intelligence provided by allies, and sensitive Canadian corporate cybersecurity and financial information.

Dissemination

Intelligence is primarily disseminated to the RCMP’s national security policing functions. The materials come in the form of briefs from their own criminal intelligence organizations and Use Letters from other intelligence organizations. The RCMP also collaborates with local police forces, the Canadian Border Services Agency (CBSA) and other government departments in distributing intelligence products. Timely dissemination of intelligence remains a major issue for the RCMP.

Oversight

RCMP oversight falls under many different institutions including: 

• Office of the Privacy Commissioner of Canada (OPC) has investigated RCMP intelligence collection techniques like cell site simulators and integration of new technology like facial recognition.

• Civilian Review and Complaints Commission for the RCMP (CRCC) is mandated to conduct reviews of RCMP national security operations, but does not have broad access to classified information. Those reviews can be blocked by the RCMP Commissioner, and an onerous process of review by a retired judge is required before the information can be viewed.

• National Security and Intelligence Review Agency (NSIRA) was created in 2019 to review the activities of intelligence agencies in Canada, replacing the Security Intelligence Review Committee. NSIRA review of RCMP intelligence functions has included reports on the interaction between Immigration, Refugees and Citizenship Canada (IRCC), CBSA - RCMP biometrics collection and storage practices and CSIS - RCMP information sharing.

• National Security and Intelligence Committee of Parliamentarians (NSICOP) has announced a review of the RCMP intelligence functions, but the report has not been released.

The Future of RCMP Intelligence

Intelligence is a critical aspect of modern policing. Significant challenges have plagued the RCMP’s collection, analysis, and dissemination of that intelligence over the force’s history and many of those challenges have not been fully resolved. The Cameron Ortis trial has also shed light on serious breaches in the RCMP’s own internal security practices. As criminal and national security issues increasingly blur, the RCMP will face new challenges around using intelligence in its investigations (the “intelligence to evidence” problem) and in responding to international criminal organizations that increasingly play a role in national security issues.

Did you find this post insightful? Share it with a colleague!

Share

© 2023 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

Professional Networks

Professional money laundering networks are networks of individuals involved in the laundering of funds for criminals. This is a service provided for criminal entities — anyone who needs to illicit move funds or create the illusion of legitimacy. The professional money launderers themselves are rarely involved in proceeds-generating criminal activity. Instead, their criminal activity is the actual laundering of funds. Professional money laundering networks arose as an adaptation to anti-money laundering regulations.

While money launderers have been around a long time, they have professionalized their services and expanded them beyond a single client. Now, the relationship between money launderers and their clients is often market-based, rather than based on criminal organization. There is an absence of obligations between parities, other than the fulfillment of the terms stipulated in their agreements.

Share

The main purpose behind these networks is to solve the problem of “cash bottlenecks”. These bottlenecks arise because illicit economic transactions are often cash-based (think drug dealing). This leaves criminals with the problem of spending large amounts of cash. This can attract the attention of authorities, and because of existing anti-money laundering rules, it can make purchasing luxury goods with cash difficult, if not impossible.

The professionals involved in these activities are often accountants and bookkeepers (to fix the books), lawyers (the use of escrow accounts and forgeries are common services they provide), as well as bankers (trusted insiders who can avoid reporting transactions to authorities). Increasingly, business people in the trading business (import/export companies) and money service businesses are used, often in combination. These businesses are often co-located, or might even be the same corporate entity.

The network aspect is important: no single money launderer can succeed for very long without partners. Think about things like the hawala system: you need individuals in other countries willing to do business with you and receive your funds. Without those important contacts and networks, you are unable to effectively move money, and your laundering methods are curtailed.

Features

Professional money laundering networks are transnational, and often involve people with different nationalities. (From a disruption perspective, this can complicate investigations as it requires international coordination.) Recently, a professional money laundering network was shut down in Italy and Spain involving 33 people from Italy, Albania, Croatia, Morocco and Syria.

These networks often use companies to launder funds. Money launderers prefer companies that deal in high-value goods, and small, high-value goods are even more preferred. For instance, electronics companies are often used as a front.

They use methods such as trade-based money laundering to clean the illicit funds. There are many different types of money laundering techniques, some of which involve real estate transactions, front companies, and even charities. One popular method is the black market peso exchange. In this drugs scheme, drug producers provide drugs to buyers (drug dealers) without payment (credit). The buyers/dealers then sell the drugs. The profits from these sales are picked up by brokers who introduce the cash into companies (the placement stage). Companies are used to order goods from China, and those goods are shipped to the United States and onward to Colombia, where the goods are sold on the open market. The profits from the sale of these goods are provide back to the drug producers.

In this way, there is no international transfer of funds that might alert authorities to the activities, and the producers receive a clean source of funds for the drugs they produced.

Tools

Professional money laundering networks use a variety of tools:

• Cryptocurrency: to move money internationally, as well as an investment. Crypto can also be used in the placement stage of money laundering by having smurfs (many individuals with only a minor role in the criminal activity) deposit funds at crypto ATMs, purchase different currencies, and then transfer the currency (or share account info) with the ultimate beneficiary

• Banks: cash can be placed in bank accounts through a similar smurfing process. Bank accounts are also useful in different jurisdictions because after a few transactions, the original source of funds is obscured

• Companies: front companies (and even real companies) are part of different money laundering schemes, providing cover for large cash deposits, trade-based transactions, and many other elements

• Cash couriers: sometimes funds simply need to be moved across borders outside of the financial system, and cash couriers are used for this purpose. The couriers might use cash, or they might use high value goods (luxury goods), or even precious metals, or the password to a cryptocurrency wallet

• Real estate: real estate is a high value good that has a subjective value, which makes it useful for money laundering or transferring funds / value between different people. It’s also a place to live or conduct business, so it has multiple purposes

• Hawala / underground bankers: organized into networks, these professionals play a vital role in money laundering and moving funds into and out of the financial system, and internationally

The Crimes

Any criminal activity can make use of professional money laundering networks. This can include kleptocracy, corruption, and other “white collar” crimes. Hiding the source and destination of funds is important for anyone who fears seizure. This also includes people trying to evade sanctions. Other criminal activity that makes use of these networks includes drug producers and traffickers, organized crime and motorcycle gangs, and other criminals who rely on these services to circumvent global anti-money laundering regulations.

Disrupting PMLs

One of the main challenges in disrupting professional money laundering networks is the issue of the predicate offence. In some jurisdictions (perhaps many), the criminal activity has to be directly tied to the laundering of the funds in order for the latter to be a crime. Increasingly, states (including Canada) are seeking to amend their laws so that the simple act of laundering funds, even if we can’t prove a criminal offence, becomes a crime. This then opens the door to having to prove what constitutes money laundering, which some states have found challenging even when it’s tied to a clear predicate offence.

On the other hand, these networks provide important sources of intelligence, so if they can be infiltrated, either through technical or human means, they can yield a treasure trove of intelligence on the business activities of many different criminals.

Share

Interested in learning more about terrorist and illicit financing? Our course on terrorist financing analysis is open now! It closes in early 2024, so don’t miss out on your opportunity to take this course!

© 2023 Insight Threat Intelligence Ltd. All Rights Reserved.

This newsletter and its contents are protected by Canadian copyright law. Except as otherwise provided for under Canadian copyright law, this newsletter and its contents may not be copied, published, distributed, downloaded or otherwise stored in a retrieval system, transmitted or converted, in any form or by any means, electronic or otherwise, without the prior written permission of the copyright owner.

Subscribe now

Regardless of the threat, it’s financed in some way. For example, if we look at threats as defined in Canada’s CSIS Act, we can see this link:

• Espionage requires money: often this is provided through state budgets, perhaps through embassies, in electronic funds transfers or in cash, but we are increasingly seeing espionage activities undertaken and financed through cryptocurrencies. States like Russia use espionage to undermine democratic principles and processes, and fund those activities directly from state coffers or through elaborate webs of companies, individuals, and accounts.

• Foreign influenced activities (aka foreign interference) are also financed in much the same way, but often using individuals as covers to provide payments to individuals or entities to help with things like the theft of intellectual property, to hide or obfuscate the true beneficial owner of a corporate acquisition (particularly in sensitive sectors like rare earth minerals,, aerospace, etc), or to simply pay individuals to undertake particular influence activities like intimidation of a diaspora community. Other examples include: Supporting the campaign of particular politicians, either through social media and influence campaigns, or in some cases through donations. These donations can be direct to the candidate, or might be received through third parties / proxies, in some cases in violation of election laws. States also pressure donors to give money to specific candidates.

  They also use information operations and social media amplification to promote a particular policy objective.1 They will also invest money, pay for advertisements, or sponsor investigative journalism or interviews to promote their interests.

• Terrorist activity of course also requires financing: terrorist groups, cells, and individuals need to raise money for their propaganda and attacks, and they move it domestically and internationally using our existing banking infrastructure as well as new technologies like cryptocurrencies.

There are also a number of other threats that have a financial component, like proliferation financing,2 sanctions evasion (those sanctions might be imposed on terrorists, human rights violators, war criminals, etc), and corruption & kleptocracy. All of these are threats to global security, and have a financial component that can be detected, and ideally, disrupted.

States and non-state actors seek to evade our detection mechanisms and finance these threats. We respond in a number of ways, including through investigation and prosecution, and also by implementing sanctions such as terrorist listings, state designations, and restrictions on import/export and investments.

In Canada, we actually have a fairly comprehensive framework to address threat financing. The problem is we lack measures of effectiveness, any real understanding of outcomes, prosecutions for violators, and meaningful investigative capabilities.  In many other countries (particularly outside of the five eyes), the concept of threat financing is developing, at best.

What we know so far:

Threat financing is a stable of threat activity, but metrics to describe it are limited. We know that there have been two successful terrorist financing prosecutions in Canada; this is far below the number from most other countries with similar counter-terrorist financing frameworks and capabilities. And there has been a financial component to every attack or thwarted plot in Canada, and FINTRAC told us in 2018 that Canada is a base for financing activities for a number of groups. But it’s unclear why Canada has so few terrorist financing prosecutions: is there a problem with the public prosecution service? Our investigative capabilities? Something in the legislation? Other countries have had more success in prosecuting terrorist financing; and while this is not the sole (or even best measure) of disruption, it’s often the most concrete, and a logical place to start.

In other types of threats, it’s the lack of data that tells the story. How many accounts have been frozen as a result of Canada’s terrorist listings? Unknown. How many Russian accounts / assets have been frozen as a result of sanctions? We don’t have a clear picture, but the RCMP has started to tell us a bit more, indicating that since February 2022, $135,671,223 in assets have been frozen in Canada, and $292,263,795 worth of transactions have been blocked. They also told us that $78,838 worth of assets in Canada have been frozen as a result of the Iran SEMA sanctions, and none under the Haiti regulations.

But there are more unknowns than known. Has Canada detected any efforts by Russia (or other state actors like the DPRK) to use Canada to evade sanctions? Unknown. But given Canada’s global connectivity, strong financial system, and technologically advanced economy, I’d estimate that there are some state and non-state actors seeking to use the Canadian financial system to their benefit. But we have little ability to detect and disrupt this activity, and almost no incentive for security and intelligence agencies to share any successes publicly.

When we look at this internationally, there are even fewer metrics.

On top of that, the diffuse nature of our system and framework for detecting and disrupting threat financing is part of the problem. We have a network of departments and agencies all with a small piece of the puzzle. Of course, attention often falls on FINTRAC, Canada’s financial intelligence unit. This is similar internationally - the financial intelligence unit is often thought to be the centre of financial issues. But in many cases, their role in threat financing is relatively limited, because they often don’t have an investigative mandate. They receive and disseminate reports, a critical function, but they are not the hub of detecting and disrupting threat financing. That role should fall to law enforcement and security services, but in practice, countering threat financing is not prioritized.

For instance, the RCMP has struggled to protect supposedly ring-fenced financial investigators and resources; instead, they have been assigned to ‘more pressing’ investigations. While we can all understand the need to prevent threat to life activities like terrorist attacks, we also need to think about the long term. We can’t continue to allow, for example, Hizballah, to run a financing network; it enables their attacks and activities against our allies and threatens regional stability and by extension Canadian interests (not to mention the reputational damage that we suffer from allowing this to continue).

Of course, CSIS also has roles and responsibilities in combatting threat financing; and while their activities will always be less public, given how little information is dedicated to threat financing issues in their public reports, I have concerns about their ability to detect and disrupt this activity, and to prioritize it within their investigations.

There are several other key members of what I consider Canada’s threat financing regime: CBSA of course, CRA charities directorate, Global Affairs Canada, and many other consumers and producers of financial intelligence like CSE, Export Development Canada, the Privy Council Office, etc. This is truly a whole of government issue, but one that has received far too little attention. Internationally, all of these bodies and agencies need to be working together to combat threat financing. I can assure you that rarely happens.

What we need to do

If Canada and its allies want a robust economy, a safe and secure financial system, a more secure global community, and a good international reputation, we need to modernize how we approach threat financing. Detecting, analyzing, deterring or disrupting threat financing needs to be front and centre of our global security discussions.

What threats to global security don’t have a financial component? What happens if we get better at detecting and disrupting the financing of threats in Canada, and internationally? I would argue that we would step more firmly into “prevention” territory, rather than reacting to emerging or developing threats. We would have the ability to detect and disrupt threats as they emerge (or even before); preventing the next terrorist attack is obviously a key objective, but so should be preventing states from using Canada and other countries as a means to evade sanctions, hide the proceeds from their kleptocracy, and acquire companies and intellectual property in sensitive or strategic sectors.

Ignoring this issue will mean that some states become a safe haven for a variety of corrupt and illicit actors; and once they become entrenched, they will become the launching pad for a variety of international security threats. When we think about global security threats, we must consider the financial dealings that underpin these activities, and focus on detecting and disrupting the flow of money.

Share

Want to read more about threat financing? Here are a few articles to get you started:

Subscribe now

There are a number of different sanctions regimes in Canada: there’s the Canadian terrorist listings process, the Special Economic Measures Act (SEMA), the Freezing Assets of Corrupt Foreign Officials Act, the Justice for Victims of Corrupt Foreign Officials Act and various other acts with other sanctioning powers / exclusions. The Special Economic Measures Act is Canada’s primary sanction tool — we use it extensively, and this is what creates our “Russia” sanctions.

In sanctions, there are four primary mechanisms: targeting, implementation, monitoring, and enforcement. In Canada, enforcement is done by the RCMP, although other departments and agencies could play a role.1 (If you’re interested in reading more about the roles and responsibilities of departments and agencies with regards to SEMA, check out the article at the footnote by my friend Mike Saunders.) Targeting is done by Global Affairs Canada. They are responsible for creating the sanctions list, and responding to enquiries and providing information to the public through the department’s website. Critics of this process point out that Global Affairs has been reluctant to provide actual advice and guidance on the implementation of sanctions.2 That implementation is done by the private sector, such as banks and financial institutions (anyone required under law to implement the sanctions). So how many sanctions breaches have there been in Canada?

In terms of enforcement, there have only been two cases brought before the courts for violations of SEMA. In 2014, an Alberta-based company (Less Specialities Ltd) was charged with violating SEMA by attempting to export controlled goods (valued at $15) to the Islamic Republic of Iran. The company pleaded guilty and agreed to pay a fine of $90,000. The company argued that issue was a “mail room mixup”; they had intended to send the goods to Dubai, but had accidentally sent them to Tehran. (As an aside, this is rather interesting, since Dubai is a well-known re-export hub for dual use goods to Iran.)

The second case involved an individual who was ultimately acquitted of sanctions violations relating to Syria. In 2020, Nader Kalai was accused of violating the Syria regulations by making a payment of $140,000 to a company called Syrialink in November 2013. When the trial opened, the prosecutor told the judge he would be calling no evidence. This might have been a result of an intelligence-to-evidence issue, with expert Michael Nesbitt explaining that some of these cases are seeded by foreign intelligence agencies, and thus the lead or originating information cannot be introduced in court.

In another interesting development, in 2007-2008, FINTRAC reported a case of individuals suspected of circumventing Canadian export controls. While FINTRAC did not specify the country or the export controls involved, the Centre did indicate that the individuals were using companies operating in Canada and abroad to do so. “The individuals were shipping restricted materials in a manner designed to avoid detection and circumvent applicable laws.” The individuals and companies had been reported to FINTRAC through suspicious transaction reports; queries of FINTRAC’s database identified additional companies suspected to be associated with the same network. Electronic funds transfers were reported indicating monthly or bi-monthly funds transfers. The transfers were ordered through foreign banks by a company located in another country to the benefit of one of the Canadian companies reported to be involved in the purchase of industrial machinery. Between 2002 and 2007, the transactions totalled over $35 million.3

Canadians violating US sanctions

While Canada hasn’t been particularly forceful in its enforcement of sanctions, the US has sentenced a number of Canadians for U.S. sanctions violations.

• In 2016, Ali Reza Parsa, a Canadian-Iranian dual citizen and resident of Canada, was sentence to three years in prison for his participation in a conspiracy to violate the International Emergency Economic Powers Act (IEEPA) and the Iranian Transactions and Sanctions Regulations (ITSR). Between approximately 2009 and 2015, Parsa conspired to obtain high-tech electronic components from American companies for transshipment to Iran. Parsa used his Canadian company, Metal PM, to place orders with U.S. suppliers and typically had the parts shipped to him in Canada or to a freight forwarder located in the United Arab Emirates, and then transshipped from these locations to Iran or to the location of his Iranian company’s client. Parsa provided the U.S. companies with false destination and end-user information about the components in order to conceal the illegality of these transactions.

• In 2017, Ali Soofi (a Canadian citizen) was sentenced to 32 months in prison after he pleaded guilty to participating in a plot to violate U.S. weapons sanctions against Iran. Between 2014 and 2016, he exported military items for the US to Iran directly and through transshipment countries without a license.

• In 2020, a Toronto export manager (Angelica O. Preto) for a Mississauga company (UE Canada Inc) was sentenced to prison in the United States for illegally exporting gas turbine engine parts to Iran, in violation of long-standing U.S. embargo and trade sanctions. During Preti’s time as export operations manager, the company was involved in 47 shipments exported from the U.S. Of those shipments, 23 were destined for Iran.

• In another case from 2020, Bahram Karimi was accused of bank fraud in an alleged money laundering and sanctions evasion scheme involving Iran’s government, a state-owned oil company in Venezuela, and a complex web of offshore accounts and shell companies (the Venezuela project). In June 2020, the case against him was dismissed because certain evidence was not disclosed to defense lawyers.  The indictment indicates Karimi lives in Canada, but offers no details of whether he used a Canadian passport or businesses in the scheme.

Other measures of enforcement / implementation

Aside from these attempted and successful prosecutions in Canada and the United States, we have few other metrics for how our sanctions are enforced. Recently, in relation to the Russia sanctions, the RCMP has told us that $292 million in financial transactions have been blocked and $122 million in assets have been frozen as a result of the SEMA Russia sanctions.

They also said that for Iran and Haiti, the RCMP has received no disclosure on frozen assets. So I suppose we are meant to assume that our Iran and Haiti sanctions have not resulted in any frozen or blocked assets. Currently, Canada has sanctions in place against twenty-two countries. I find it hard to believe that there are no other frozen or blocked assets in Canada from any of these countries, or that there have been no attempts to evade these sanctions. Food for thought as we consider the utility and implementation of sanctions, and how to investigate and enforce potential breaches of sanctions in Canada.

Did you find this interesting? Share it with a friend, and don’t forget to subscribe!

Share

Subscribe now

Twenty-One Years of Reporting

Since its inception in 2000, FINTRAC has put out an annual report every year (except 2000-2001). Reading through twenty-one years of FINTRAC history is an exercise in and of itself, and re-reading the reports from my time there (2009-2013) brought back some very fond memories. It also provides some interesting data that we can use to start to answer the question about what FINTRAC’s role is in Canada’s counter-terrorist financing regime, how it goes about fulfilling it, and how effective it is in that role. While those are some big questions (and well beyond the scope of this newsletter, and probably FINTRAC’s annual report itself), let’s talk about some interesting data from these reports. First of all, there were far fewer disclosures made on terrorist financing / threats to the security of Canada, a level not seen since 2012. Does this mean there is less terrorist financing in Canada than in prior years?

The decrease in terrorism financing and threats disclosures was not due to a significant decrease in reporting to FINTRAC. Overall reports sent to FINTRAC remained about the same, although some pandemic effects were clearly visible in the reporting. For instance, there was a significant decrease in casino disbursement reports, as well as large cash transaction and cross-border currency (and seizure) reports. These types of reports are sensitive to pandemic effects: for instance, closed borders and less travel was a likely causal factor for the decrease in cross-border activity (these reports result from the seizure or declaration of cash in excess of $10,000).

Far less reporting from casinos

Large cash transaction reports also likely experienced a serious pandemic effect with a general move away from cash in the economy (whether this persists in future years will be interesting to see), and of course the closure of casinos, which likely accounts for the majority of the very notable decrease in casino reports. (Casino disbursement reports involve any disbursement of $10,000 or more.) The volume of casino reports was down almost 86% from the year before; casinos were closed for a good part of the year. However, this decline is something that we should keep an eye on, particularly given the Cullen Commission and the issues that were raised with regards to the detection and reporting of transactions from the casino sector.

Less terrorism and fewer threats?

The decrease in disclosures relating to terrorist financing and threats to the security of Canada is one of the more interesting datapoints. This decrease suggests that the Centre is:

• receiving fewer financial transactions relating to these threats; and/or

• receiving less information from partners in the form of voluntary information about threats (this information helps FINTRAC meet its grounds for disclosure); and/or

• having greater difficulty meeting grounds for disclosure for other reasons.

FINTRAC provides financial intelligence to law enforcement (usually the RCMP) when the Centre has reasonable grounds to suspect that the information would be relevant to a terrorist activity financing investigation. Disclosures relevant to foreign intelligence are disclosed to CSE when the information is relevant to the foreign intelligence (interference) aspect of CSE’s mandate, and disclosures are made to CSIS when that information would be relevant to threats to the security of Canada. (Threats disclosures can also be made to law enforcement.)

Together, these types of disclosures are categorized in the annual report as “TF/TH” threats (in blue), and also are also categorized as “TF/TH/ML” disclosures (in brown) when there’s a money laundering component. Categorizing disclosures can be tricky: there are often multiple different activities at play.

This year, disclosures relating to threats and terrorist financing are down almost 51% from the previous years. While these disclosures have been decreasing in recent years (starting in 2017-2018), this is the largest decrease to date. This might be due to a decreasing terrorism threat: my research indicates that terrorist attacks (one measure of levels of terrorism) are down notably, in part due to the pandemic. However, this decrease is curious, particularly in a world of evolving threats like ideologically motivated violent extremism. It makes me wonder whether FINTRAC’s mandate is allowing them to disclose on some of these newer threats, or if there might be a gap or mandate issue.

Insight Intelligence

The Pandemic Effect: Declining Levels of Terrorism

Welcome to our new subscribers! Our community is growing slowly but steadily, thanks to all your referrals and sharing of this newsletter. I appreciate it! In this analysis, I look at how terrorism has changed during the pandemic. I use the rates of female terrorist attacks worldwide to estimate levels of terrorism during the pandemic. I draw on a…

Read more

4 years ago · Jessica Davis

It's also worth noting here that despite over 4,600 disclosures potentially relating to terrorist financing (this number includes threats disclosures as well), we have had two terrorist financing convictions in Canada. This despite the fact that FINTRAC has written clearly about the terrorist financing threat in Canada in its 2018 report, outlining the various groups that are active in Canada. There’s clearly a discrepancy here in terms of how FINTRAC sees terrorist activity financing and how police are investigating and prosecuting that activity.

For several years now, FINTRAC’s annual reports have emphasized the terrorist activity investigations where their financial intelligence has played a role. For instance, this year, the report noted their contribution to an investigation that resulted in a Toronto-area woman being charged with participation in activities of a terrorist group in Canada.1 While not named specifically, this is likely the case of Haleema Mustafa, who was charged with terrorism-related charges for travelling to Turkey to join the Islamic State – charges that were later stayed. While no details about FINTRAC’s contribution were provided, this could have included suspicious transaction reports (perhaps banks identifying any ATM use in Canada or overseas relevant to the investigative time-period) or international electronic funds transfers of $10,000 or more). This demonstrates that despite the lack of terrorist financing charges and convictions in Canada, FINTRAC’s intelligence is clearly useful for terrorism investigations. However, the full extent of that usefulness remains unclear. Does FINTRAC provide value for its budget in terms of helping to detect and disrupt terrorist financing and threats to the security of Canada? This remains an unanswered question. While we have some qualitative support for the role of the Centre in the form of testimonials from partner agencies, concrete examples of its role and quantitative data showing effects and outcomes remains sparse.

If you want to read about the 2021-2022 report, here you go:

Share

Share

Terrorist Listings and the Anti-Terrorism Act, 2001

The Canadian listings process is brought to us by the Anti-Terrorism Act of 2001, and is set out in section 83.05 of the Criminal Code. When it was written, this section was the subject of some controversy, and legal scholars note that the listings process might be “constitutionally suspect”.1 The listing regime first arose following the UN Security Council resolution 1267, which prohibited financial transactions with the Taliban (and Al Qaeda, later) affiliates listed by the Security Council, implemented under Canada’s United Nations Act.2

So what’s an entity?

Only “entities” can be listed as terrorists. An entity can be a person, group, trust, partnership, fund, or an unincorporated association or organization. Organizations are further defined as a public body, body corporate, society, company, firm, partnership, trade union, or municipality, association of persons created for a common purpose, that has an operational structure, and holds itself out to the public as an association of persons.3 So this means that both groups and individuals can be listed as terrorist entities. For instance, we have two individuals listed, Gulbudding Hekmatyar and James Mason, many groups that are commonly identifiable as terrorist groups (like ISIL, Al Qaeda, etc), as well as organizations like the World Tamil Movement and the not-for-profit organization IRFAN.

What remains to be seen is how the listing process evolves with the terrorism landscape. There are currently a number of movements that can be described as extremist in nature4 and whose adherents have engaged in acts of violence motivated by politics, ideology, or religion. For instance, some Boogaloo,5 QAnon6 and Incel adherents have engaged in acts of violence that can be characterized as acts of terrorism. Will we see efforts to list some of these movements as terrorist entities? To my mind, they lack an operational structure. However, the listings process isn’t an entirely rational or a-political process, and it’s unclear if operational structures are a requirement. As such, we may see more listings rather than fewer in the coming months and years, particularly in the absence of any constitutional challenges that force a re-think of some (or all) of these provisions.

Who decides if an entity should be listed?

The ultimate decision to list an entity is the Governor in Council, but that decision is based on a recommendation from the Minister of Public Safety. In order to provide the Minister information upon which to base this recommendation, members of the Canadian security and intelligence community provide information as part of a listings package. This process is usually lead by CSIS or the RCMP, who are the ‘lead pen’ on criminal or security intelligence reports. In some cases, they may draft the listings package based entirely on their own information, or may request or incorporate information from other departments and agencies in Canada, including FINTRAC, CSE, CBSA, Global Affairs Canada, etc.

The threshold for listing is “reasonable grounds to believe” that:

Nomination to be listed

Terrorist entities are nominated for listing in a number of ways. Traditionally, law enforcement and security services consult with the broader intelligence community to determine potential nominees; much of this involves ensuring that the list remains updated with the most recent iteration of a terrorist group’s naming convention. In more recent years, some listings might have come about because of a call for listing in the House of Commons and/or at the direction of Public Safety Canada, which leads a coordinating committee. However, regardless of how they are nominated, evidence of their activities has to be obtained, and that evidence has to amount to reasonable grounds to believe that they have knowingly carried out, attempted, participated, or facilitated a terrorist activity, or knowingly acted on behalf of, at the direction of, or in association with an entity that engaged (or tried to engage) in terrorism.

For example, the Taliban has been a listed terrorist entity in Canada since 2013, but specific sanctions have also been in place under the UN Act (as part of Canada’s implementation of international sanctions against the Taliban) since 1999. On the other hand, the Proud Boys have only been a listed terrorist entity in Canada since 2021. There is a lot of variation in the reasons for listing between these two entities, including the specific use of violence by each group.

The information used for the listings process can be classified or unclassified, although an unclassified summary is always provided on Public Safety Canada’s website. However, the full package of information supporting the listings can be far longer than the public information suggests.

What are the concrete impacts of listing?

When a group becomes a listed entity, the group itself isn’t outlawed, and it isn’t a crime to be a member of the group.7 For the Taliban and the Proud Boys, this means that it isn’t illegal to be a member of the group. However, if an individual’s membership in that group is a matter of public information, further issues might arise for that individual. (More on that in a minute.)

• However, it IS an offence to participate or contribute to a terrorist group, either directly or indirectly. BUT this is only an offence if its purpose is to enhance the ability of a terrorist group to facilitate or carry out a terrorist activity.

The criminal code specifies that it’s a crime to provide property or financial services that could benefit a terrorist group. Basically this means you can’t finance a terrorist group but they don’t have to be listed for that prohibition to be in place. And you can’t finance other types of entities if the purpose of that financing is for terrorist activity, but you can provide funds for people or other types of entities for non-terrorist purposes. (This makes some sense - James Mason’s hypothetical employer isn’t financing terrorism by paying him, for example, and donors to a listed charitable organization aren’t financing terrorism unless that organization is a terrorist group, or if the purpose of those funds are for terrorist activity. Still a little fuzzy, I’m sure, and we haven’t even delved into the idea of self-nominating terrorist groups...8)

As Michael Nesbitt notes, the listing process circumnavigates the definition of terrorist activity somewhat with regards to financing a group. The listing process allows prosecutors to rely on the terrorist entity listing without reference to the definition of terrorist activity.9

Upon listing, an entity’s property can be seized, restrained, or forfeited. This means that any accounts held in the name of the Taliban in Canada can be seized, restrained, or forfeited. However, this is unlikely to occur because

• a) most terrorist groups don’t actually hold accounts in their names or the names of their leaders, and

• b) this is particularly unlikely for groups that operate largely outside of Canada.

  Where this has actually been more common is for the listing of organizations (including charitable or non-profit organizations) in Canada. Similarly, it’s unlikely (although not impossible) that the Proud Boys had any accounts at banks or financial institutions that could be seized, restrained or forfeited. The most likely scenario is that a regional chapter of the group might have had a small account at a local financial institution, but even this scenario is fairly unlikely.

  Insight Intelligence

  Proud Boys Financing

  In February 2021, the Canadian government listed the Proud Boys as a terrorist entity under Canada’s Criminal Code. Despite this listing, a website associated with the group continues to operate and is accessible where people, including from Canadian IP addresses, can purchase merchandise and make donations to the group. Merchandise sales and donations …

  Read more

  5 years ago · 2 likes · Jessica Davis

At the same time, banks, brokerages, and other financial institutions / entities have to report that they hold terrorist property if they identify any accounts / property in the name of the group, and they can’t allow the entities to access the property. The financial institutions cannot dispose of the property - instead, they essentially have to freeze it.

The law applies to the listed entity, but practically speaking, it extends to individuals associated with it. For instance, if a financial institution like a bank has an account in the name of someone who has been publicly identified as a member of the Taliban, upon listing, they will freeze, seize, and restrain that account or property. Most financial institutions are very risk-averse, and will do this when they suspect that an individual may be a member of a terrorist group. That suspicion is usually based on public information that identifies the individual as a member of the group, and can be obtained through the financial entity’s own social and media monitoring, or through services like Refinitiv World Check / Accelus World Check One.

If individuals are identified as being “associated with” a terrorist group, financial institutions must report any property that they hold to the RCMP, CSIS, and FINTRAC, Canada’s financial intelligence unit, in a terrorist property report.

For the Taliban, it is unlikely that the group had named, publicly-identified members in Canada. For the Proud Boys, the situation is different. There are dozens of individuals in Canada who have been publicly identified as “associated” with the Proud Boys, through attending their protests and rallies, or through social media activity. This means that anyone publicly associated with the group may have been reported to FINTRAC, most likely through suspicious transaction reports. In fact, this is one of the tangible benefits of the listing process. Without being a listed terrorist entity, reporting entities might have insufficient grounds to report a client’s transactions. However, if they become aware of their client’s confirmed or potential association10 with a listed terrorist entity, this usually meets their threshold for reporting.

Concurrently, most banks and financial entities, when confronted with the idea that they may have business dealings with someone associated with a listed terrorist entity, will choose to exit (or “de-risk”) that business relationship. Some of my banking sources tell me that in the case of the Proud Boys, this happened within hours of the listing being made public. This effectively means that they had their accounts frozen, and were instructed to find alternative banking arrangements.

National Security Implications of Listings

For national security and intelligence agencies, the listing process doesn’t do all that much. For investigative agencies, it changes little in their activities. Both CSIS and the RCMP have a mandate to investigate potential terrorist activity regardless of whether the entity the activity associated with is a listed entity. For other agencies, like those primarily involved in analysis or collection (like FINTRAC), but without a broad investigative mandate, this can enable further research, analysis, and dissemination of intelligence, including financial intelligence. The listing process establishes that there are reasonable grounds to believe that an entity is involved (or has been involved in) terrorist activity, allowing some of these organizations more operational space.

Insight Intelligence

Financial Intelligence: A Primer

Welcome to the new subscribers to Insight Intelligence this week - thanks for joining the hundreds of people who are already part of our community. If you think someone you know would be interested in joining us, please share this post! Today I want to talk to you about a little-studied “int” in the intelligence community: financial intelligence. This t…

Read more

5 years ago · 3 likes · Jessica Davis

In some cases, the listing process may unlock additional resources for investigations, although this is not guaranteed. Further, listings are not required for this - political will is.

The listings process is about trying to ensure that the Canadian financial system isn’t being used by terrorists, but it’s hard to say if that’s actually what’s happening. Financial tradecraft, third parties, proxies, shell companies, and lack of investigative resources assigned to investigate terrorist activity financing all work against this goal.

The Delisting Process

The delisting process is full of mysteries. There is no precise standard of evidence for delisting; instead, it happens on the recommendation of the Minister.11 Historically, only one group (that I recall) has been de-listed, and that’s the Mujahedin-e-Khalq (MEK). When the group was de-listed, the government offered no explanation, but was following the lead of the United States and the European Union who de-listed the group shortly before.

Entities can petition for delisting, but in Canada there has been no successful petition to date. In the case of this process, however, the government could face disclosure implications depending on the type of information that they relied on, and whether it was classified or unclassified, and if classified, if it included only Canadian or allied reporting.

Unfortunately, a lot of information about the listings process is excluded from disclosure through access to information requests due to its categorization as “confidence of the privy council” or as advice or recommendation to the Cabinet or the Minister, as I found out following an access request I placed on the listing of the Proud Boys.12

Subscribe now

Other Implications

As noted before, the listings process may be on uncertain ground constitutionally. Further, the listings process can effectively de-bank Canadians; this would happen through Canadian financial institutions identifying a potential association between an individual and a terrorist organization, and refusing them financial services. If all the banks and financial entities in Canada did this, the hypothetical, terrorist-associated individual could effectively be de-banked from the Canadian financial system. However, Canadians have a right to open a personal bank account at a bank (with some exceptions / limitations). It’s unclear how this would work or how an individual could get recourse. I asked the Financial Consumer Agency of Canada for clarification, and they pointed me to the Access to Basic Banking Services Regulations, part of the bank act. In order to refuse to open an account, banks need to have reasonable grounds to believe (note the high threshold of belief) that the account will be used for illegal or fraudulent purposes.

Still have questions about the listings process? Leave a comment and I’ll do my best to update this summary with more information!


Subscribe now

Today I want to talk to you about a little-studied “int” in the intelligence community: financial intelligence. This type of intelligence is generally considered to be the domain of financial intelligence units, but as I wrote about here, lots of other types of collection generate financial intelligence (or FININT, for short). I also talk about the use (and abuse) of FININT in my new book, Illicit Money: Financing Terrorism in the 21st Century.

Purchase: Illicit Money

So who generates FININT? Well, banks, financial institutions, money service businesses like MoneyGram, WesternUnion, and many others, all generate financial data. But in my view, that data doesn’t actually become intelligence until it’s combined with other sources of information and contextualized.

This is part of the problem in the counter-terrorist financing, anti-money laundering, and sanctions evasion world. Most reporting entities (as banks and other financial bodies are called when they are required to report transactions to financial intelligence units) don’t actually generate financial intelligence. They generate financial data. In some cases, they’re able to contextualize their reporting (usually through suspicious transaction reports), coming close to providing intelligence, but mandatory reporting fall squarely in the realm of financial data, not intelligence. It’s up to the financial intelligence units (FIU), law enforcement agencies, and security services, to turn that into FININT.

So how do they do it? Well, banks and other entities report suspicious transactions, and in some jurisdictions, they report other mandatory transactions. (For instance: in Canada, any international transfer of funds of $10,000 or more is required to be reported to FINTRAC, Canada’s FIU. Regulations vary by country.) These transactions are reported to the FIU which in turn discloses relevant information to law enforcement and security services. (Again, there’s a lot of variation in how this happens, and in some countries, the FIU IS a law enforcement entity.) This information is then combined with other information holdings - often human intelligence, police reports, or, in some cases, signals intelligence, to determine the relevance of the transaction to an investigation.

But this is not the only source of financial intelligence. FININT can actually be derived from a lot of other reporting mechanisms. For instance, human sources can (and do!) report on subjects of investigation and their financial situation, transactions, and relationships. Pocket litter and refuse collection can also provide financial intelligence. All of these types of collection can fall into the category of FININT. FININT can also be obtained directly from banks and other financial institutions, through SIGINT collection, and lots of other collection platforms. With the advent of the blockchain and social media platforms, some FININT can now also be obtained through open source collection methods.

Like most other “ints”, there is expertise required to analyze and assess FININT. Analysts need to understand the source of the information - is it being generated by mandatory or suspicious reporting? What are the grounds of suspicion? Is the information being reported as a form of defensive reporting, or are the grounds of suspicion well-established? Does the source have direct knowledge to the information? Is their access well-understood, established, and trustworthy?

A particular challenge comes in dealing with FININT reporting derived from human sources or by listening to a conversation. People often talk about future activities - things they will or want to do. I’ve often seen this reported as a completed transaction, which it’s not. And in some cases, that information is being shared to influence the recipient of the information - potentially also including intelligence agencies.

Aside from these fairly standard concerns about source information, financial intelligence also requires a facility with technical information. Analysts need to know what the various types of SWIFT reports mean, for instance, and often need to understand corporate structures, reporting requirements in particular countries, and many other things. Analysts also need to establish a pattern of life for subjects of investigation - something that can become quite complicated if that extends to corporate structures. Establishing a corporate history or pattern of practice can involve looking over years worth of information - a time consuming, and often unsatisfying - endeavour.

Financial intelligence analysts also have to have a real interest in personal finance. Lots of people I talk to have no interest in their own finances, let alone those of other people. To do this work properly, you have to be really nosy, and willing to dig deep to understand the purpose of a transaction.

FININT is a powerful source of information. It can shed light on the capabilities, planning and preparations of a subject of investigation - this of course applies to counter-terrorism investigations, but also extends to other threats to national and international security, such as sanctions evasion, proliferation activities, espionage, influence activities, etc.

Making use of FININT

Financial intelligence is an under-used, and poorly-understood type of intelligence. Part of this is because financial intelligence analysts have failed to contextualize the information properly. In some cases, it’s because they have made logical leaps trying to establish a link to threat activity that is poorly articulated or non-existent, failing to accurately describe the relationship or association between entities or individuals. In other cases, the fault lies with investigations and a disinterest / inability to assimilate financial intelligence. Yes, you are probably going to have to use a spreadsheet, and probably advanced analytic visualizations that are available in programs like Tableau. Globally, states are required to generate and use financial intelligence - and they have to dedicate serious resources to doing that. So I’m on a mission to improve intelligence analysis of FININT, encourage its exploitation, while also keeping an eye on the misuses of this type of intelligence collection.

At the same time, it’s important to remember that FININT (as with other types of intelligence) can be used by repressive regimes to enhance their surveillance capabilities. But FININT is unique globally in that the development and exploitation of financial intelligence is an international requirement. Unfortunately, the international community has yet to fully come to grips with the mis-use of financial intelligence and the implications for human rights and lawful protest.

Share