The terrorist threat posed by lone actors is 'difficult to detect,' says federal report

Violent extremists in Canada have the "intent and capability" to commit acts of terrorism, but detecting attacks by lone actors or small groups before they happen is "difficult," says an internal threat assessment conducted for the federal government last year.

The warning is found in a threat analysis prepared by the federal government's Integrated Terrorism Assessment Centre (ITAC) in the lead-up to last year's muted Canada Day celebrations.

At the time, the team — which works with the Canadian Security Intelligence Service (CSIS) to advise the federal government on terrorist threats — was worried that ideologically or religiously motivated extremists could seize the occasion of the national holiday to make a violent statement. 

While no known attacks happened last July 1, the analysis shines a light on the things the secretive agency looks for in advance of special events and the challenges it faces detecting would-be attackers. 

"An attack on a Canada Day 2021 celebration or legitimate public protest is most likely to be conducted by an inspired lone actor or small group using unsophisticated methods such as firearms, bladed weapons, vehicles or homemade explosives," ITAC concluded in its report, obtained by CBC News through an access to information request.

"Such attacks require little planning and are difficult to detect."

Jessica Davis is a former senior intelligence analyst with CSIS who now heads the consulting firm Insight Threat Intelligence. She said lone extremists can stay "completely off the radar" until it's too late. 

"Lots of people are radicalized. Lots of people hold extremist views. Only a very small minority actually take action on them," she said.

"So the challenge is really figuring out who in that big bucket is actually going to do something."

Barbara Perry is the director of the Centre on Hate, Bias and Extremism at Ontario Tech University. She said that while her team has identified about 300 right-wing hate groups in Canada, identifying those who pose a threat without necessarily belonging to any of those groups is nearly impossible.

"Many of these actors don't necessarily themselves engage. They're consuming but they're not producing necessarily online, so you're not going to see those red flags on their social media," she said.

"I don't think anyone has identified a sort of effective profile of who these folks are."

CSIS watches for flags — like maxed-out credit cards

Back in 2018, CSIS launched a study of what spurs someone to engage in terrorist activity.

According to the agency's analysis, a radicalized person's journey from "mobilization" to violence — from intent to action — takes on average about 12 months.

That report concluded that CSIS analysts can't detect the next terrorist by looking at characteristics such as age, gender or socio-economic background. It said its analysts focus instead on indicators like an individual changing their physical training routine, maxing-out a credit card or putting personal belongings up for sale.

The growing concern about ideologically motivated violent extremism (IMVE) — a broad term used by CSIS to cover extremism based on various grievances, including those expressed by far-right, anti-government and racist groups — weighed heavily on the pre-Canada Day assessment.

In-person Canada Day celebrations on Parliament Hill were cancelled last year due to the pandemic. As ITAC was putting together its analysis, some provinces and regions had started easing their pandemic restrictions and were hosting events.

Based out of the CSIS headquarters in Ottawa, ITAC is made up of officials from departments and agencies tasked with security and intelligence. ITAC produces its reports for senior decision-makers based on classified and open-source information.

"Despite continued limitations, opportunities will exist for terrorist actors to cause mass casualties or conduct symbolic attacks on Canada Day," says ITAC's summer 2021 assessment.

"Violent extremists in Canada have the intent and capability to conduct a domestic act of terrorism."

The analysis goes on to say that "crowded areas, symbols of government and security personnel could be targeted specifically."

The ITAC team said would-be attackers who are unable to access their intended targets due to things like security barriers likely would adjust by "redirecting their terrorist intent to a more easily accessible target," such as bystanders, less secure gatherings and symbolic people or places.

Canada's counterterror tools can't cope: former analyst

Davis said Canada's security apparatus struggles to detect lone actors in part because many of its counterterrorism tools were set up to detect terrorist cells or organizations.

"So we haven't fully adapted, I would say, to the lone actor environment," she said.

Perry calls it the "atomization of the movement ... where you do have more and more individuals who were drawn to the narratives, drawn to those online spaces and don't necessarily affiliate with a particular group.

"We talked about them cherry-picking little bits and pieces that seemed to suit their needs or their individual situations," she said. "How do you count them? We haven't."

Davis said Canada could bring up its counterterrorism game by boosting the resources it devotes to it at a time when both CSIS and the RCMP are struggling with recruitment and retention.

"If you just don't have the people to run the investigations and the resources assigned to support those investigations in terms of analysis, there's going to be a lot of things that you miss," she said, adding that Ottawa should be ensuring the security sector has "the right tools, techniques, technologies" and "authorizations" to do the job.

Perry said Canadians also need to be educated on the signs of radicalization.

"One of the things I keep thinking about is building capacity more broadly in terms of caregivers and educators — and even youth, who probably spend more time than parents do with other youth — in terms of how can we help them to identify red flags, like certain changes in ... the kind of language people use," she said.

As an example of an assault by a lone actor, the ITAC analysis cited the June 2021 vehicular attack in London, Ont. that claimed the lives of four members of a Muslim family.

On June 6, 2021, the Afzaal family was struck by a truck on Hyde Park Road in what police described as a crime motivated by anti-Muslim hate.

Salman Afzaal, 46, his 44-year-old wife Madiha Salman, their 15-year-old daughter Yumna and her 74-year-old grandmother, Talat Afzaal, were killed while out for an evening walk. The couple's young son was seriously hurt.

Nathaniel Veltman, 21, faces four counts of first-degree murder and one count of attempted murder.

That event "demonstrates how the confluence of ideological beliefs, personal grievances and possible triggers can mobilize threat actors to violence," wrote ITAC.

While the report was compiled last spring, the Canadian agency's warnings were brought into sharper focus by Saturday's devastating mass shooting in Buffalo, N.Y. which left 10 people dead at a supermarket.

U.S. officials say the 18-year-old alleged shooter had repeatedly visited websites espousing white supremacist ideologies and race-based conspiracy theories.

Davis said media reports on the alleged shooter indicate a number of points where authorities could have anticipated and prevented the attack.

"There was also a series of financial purchases that he made, particularly weapons and gear and components for his attack, that had he been the subject of investigation would have been able to allow investigators to see sort of an escalation in behaviour and escalation in his mobilization of violence," she said.

"The challenge in the United States, of course, is that things like a weapons purchase isn't really a useful indicator because it's such a pervasive activity."

21 killed on Canadian soil by extremists: CSIS

According to CSIS's latest annual report, tabled in Parliament earlier this month, lone actors remain the primary IMVE threat.

"Since 2014, Canadians motivated in whole or in part by their extremist ideological views have killed 21 people and wounded 40 others on Canadian soil," said that annual report.

Asked whether CSIS has any concerns about this year's Canada Day's celebrations, agency spokesperson Brandon Champagne said it can't "publicly comment, or confirm or deny the specifics of our investigations, operational interests, methodologies or activities."

"The COVID-19 pandemic has exacerbated xenophobic and anti-authority narratives, many of which may directly or indirectly impact national security considerations. Violent extremists continue to exploit the pandemic by amplifying false information about government measures and the virus itself on the Internet," he said.

"It is important to note that the national terrorism threat level has remained unchanged, at MEDIUM, since October 2014."