Key takeaways
- On October 29, 2026, NSIRA published review 24-10 of DND and Canadian Armed Forces open-source intelligence on the internet. The review found the collection lawful, but found gaps in documentation, risk management, privacy protections, and oversight.
- Fifteen third-party providers that specialize in collecting information about individuals had not been evaluated, and risk assessments were not updated regularly and did not address all relevant risks.
- Collection was not consistently tied to approved defence operations, and policies and records did not adequately show that collection involving Canadians was necessary. NSIRA made five recommendations, and the same tests apply to any team running OSINT in the private sector.
The military can read the public internet. Nobody disputed that. On October 29, the National Security and Intelligence Review Agency published its review of how the Department of National Defence and the Canadian Armed Forces collect publicly available information online for intelligence purposes. The verdict split in two: the collection is lawful, the governance around it falls short.
The review traces back to press reporting on Canadian Forces activity during the pandemic. NSIRA’s job was to test whether the collection was lawful, necessary, and subject to appropriate safeguards, particularly when it touched Canadians. Lawful, yes. Necessary and safeguarded, not demonstrated.
What the review found
Four gaps, in the review’s own terms:
- Documentation. Collection activities are not consistently linked to approved defence operations or activities.
- Risk management. Risk assessments are not updated regularly and do not address all relevant risks.
- Third-party providers. Fifteen providers specializing in collecting information about individuals had not been evaluated.
- Privacy and oversight. Existing policies and recordkeeping do not adequately address all privacy risks or demonstrate that collection involving Canadians is necessary.
Read the list again and stop at the third line. Fifteen. Fifteen suppliers whose business is collecting information about individuals, with no evaluation on record. That is the number that should stop any practitioner skimming this piece. Your own version of it is the people-search vendor, the social listening tool, the data broker whose dossier lands in your investigations file. The question is the same one NSIRA asked: did anyone evaluate them before the names started flowing?
| NSIRA’s finding | The test for your shop |
|---|---|
| Collection not tied to an approved operation | Can you name the purpose behind your last OSINT pull? |
| Risk assessments stale and incomplete | When did you last update yours, and does it cover your current tools? |
| Fifteen people-data providers unevaluated | Is every supplier that collects information about individuals evaluated on file? |
| Records do not show necessity | Could you prove to a regulator tomorrow that the collection was necessary? |
The sentence that carries the review
“Information that is publicly available online can still raise privacy concerns when collected and analyzed by government organizations.” That is NSIRA’s sentence, and it is the one most shops get wrong. The comfortable view is that public means free: a post, a profile, a listing, fair game once it is visible. The review says no. Authority to collect is not a free pass. The collection still has to be necessary, documented, and overseen. Quebec’s Law 25 makes the same point in statute with a narrow list of what counts as publicly available information, and anything you can find online is not on it.
There is an awkward trade here that the review does not resolve. Open-source collection is cheap, fast, and often the only way to answer a real question. Tightening it costs time and sometimes the answer. NSIRA’s position is that the cost is the point. The record is what makes the collection defensible. If your team treats OSINT as free because it is public, you are running the same gap at a smaller scale.
Your desk this week
- Tie every OSINT pull to a named purpose. If a search has no written purpose and no approved operation or file behind it, it does not run.
- Open the vendor file for every people-data supplier. A provider that collects information about individuals with no evaluation on record is the finding, word for word. Fix it before a regulator reads it back to you.
- Date your risk assessment. If it predates the tools you use now, it is stale, and stale is what NSIRA flagged.
Actionable takeaway: Pull the last open-source search your team ran and ask for three things: the purpose it served, the evaluation behind the tool that ran it, and the risk assessment that covers it. One missing piece is a gap. Two is a pattern. The backgrounder publishes no response or timeline from the department, so what DND does with the five recommendations is the open thread.