A Natterjack sighting!

Or, the RCMP questions itself after the Freedom Convoy

In the immediate aftermath of the Freedom Convoy protests and blockades, the RCMP ordered an internal review of its responses, which it kept out of the public eye. The codename was “Natterjack.”

(Just in case this name rings some distant bell, a natterjack is a rare species of toad, found in Europe, with a yellow stripe down its back, short legs and a “loud rasping call,”  at least from the males. Sounds a bit nasty—let’s hope the code name was computer generated.)

This Natterjack had two review components. The first was a questionnaire provided to all RCMP members, uniformed and civilian, who were involved in the Mounties’ response to the Freedom Convoy. The questionnaire was open for a month from September 6 to October 7, 2022. A total of 2139 individuals responded. When scrubbed to exclude answers from personnel who did not play a role in the Freedom Convoy events, the total survey involved 1641 respondents.

The second element of the review involved an analysis of the responses and recommendations offered by a retired RCMP assistant commissioner, Eric Slinn, brought in for this purpose in January 2023.

Natterjack was organised around four key themes:

RCMP command and control

Intelligence sharing

Mobilization of RCMP members to assist in policing

Employee wellness during service in response to the Freedom Convoy protests

Jim Bronskill for Canadian Press produced an excellent overview report on Project Natterjack based on documents he obtained through an Access to Information Act.^[1]

I now have access to the same release package of documents used by Mr. Bronskill in his news report.

What follows is my own reading of Project Natterjack findings—which have never been released publicly. I am going to focus on findings about RCMP intelligence activities during the Freedom Convoy, a key question that was subject to some discussion during the Public Order Emergency Commission (POEC), but which never resulted in substantial analysis or recommendations, one of the Commission’s key failings in my view. Incidentally, although the RCMP was conducting its questionnaire during the time when the POEC was holding its public hearings in the Fall of 2022 and Commissioner Slinn  was brought in as a reviewer well prior to the POEC report in February 2023 , there is no indication that POEC was ever made aware of Natterjack or its findings.

Project Natterjack’s approach to the intelligence question was defined as follows:

“How the threat picture was collected, assessed and shared amongst agencies responsible for responding to the Freedom Convoy.”

That suggests a holistic and strategic examination of the intelligence cycle, but the reality of the Project Natterjack report was somewhat different and often focused on process issues rather than the substance of intelligence reporting. In particular, as we shall see, Natterjack had nothing to say about how the intelligence was “assessed.”

The intelligence chapter of Natterjack (chapter 2) opens with a picture of multiple intelligence units involved in the RCMP response.  There was a total of six different RCMP intelligence units in the mix, all operating in the National Capitol region—a recipe itself for problems with coordination and coherence of the intelligence picture.

The six included the following:

Protective Intelligence unit

Combined Intelligence Group

Joint Intelligence Group

Ideologically Motivated Criminal Intelligence Team (IMCIT)

Federal Policing Criminal Operations—Financial Crimes Unit

Tactical Internet Operational Support

In addition, there was intelligence work conducted independently by RCMP Divisions in Alberta (K Division) and BC (E Division) where contract policing duties brought them into front-line responses to Freedom Convoy border blockades.

The quantity of reporting from all these diverse units was in some instances impressive, maybe even overwhelming--and no doubt often duplicative.

To an extent each unit had a specific and distinctive purpose. The problem was that none of them were designed to produce intelligence on public order threats or to coordinate the whole effort. So what were they all doing?

The role of the Protective intelligence unit was to provide intelligence reports to assist the RCMP in its  protective operations role (for the PM, designated Ministers, and other VIPs)

The Protective intelligence unit also took the lead role when the “Combined Intelligence Group” was activated on the first weekend of the Ottawa protest occupation (Friday January 28 to Sunday January 30, 2022). The Combined intelligence  group functioned as a sort of intelligence fusion  centre for Ottawa area law enforcement partners. Its reporting remained focused on protective policing, and it churned out an astonishing total of 240 reports between January 28 and February 27 –on average 8 reports per day, all at the tactical level, designed for front-line use.

The “Joint Intelligence Group,” like the Combined Intelligence Group, was only activated during the events of the Freedom Convoy and was created to support the RCMP’s distinctive command system. Its shelf life was shorter than the Combined Intelligence Group, as it came into existence only on February 12, 2022 (on the eve of the invocation of the Emergencies Act) and was disbanded two weeks later, on February 26.  It produced 40 “situational updates” between February 14 and 27 that were distributed within the RCMP and to security and intelligence partners in the federal government.

The financial crimes unit of federal policing criminal operations became involved in responses to the Freedom Convoy only after the Emergencies Act was declared and a mechanism was created to block the accounts of individuals (“designated persons”) connected to the Freedom Convoy. The Financial crimes unit became the conduit for sharing information held by the RCMP with financial institutions, who could then take action. According to the Natterjack report, between February 15 and 23, when the Emergencies Act regulations were in effect, Financial crimes made 57 disclosures to financial institutions, naming 62 individuals and 17 businesses.

Tactical internet operational support, as its name suggests, was utilised to provide open source intelligence to the Combined Intelligence Group and the Joint Intelligence Group as well as to K Division (Alberta) to support a criminal investigation and to D Division (Manitoba) to provide situational awareness regarding the blockade at the Emerson POE.

This brings me to IMCIT. In the absence of any pre-existing, dedicated intelligence bureau within the RCMP to deal with public order emergencies , the job largely fell to a little known unit called the Ideologically Motivated Criminal Intelligence Team (IMCIT), which operated under Federal Policing, National Security.  The Natterjack report notes that the role of the IMCIT was to provide “strategic intelligence” on the ideologically motived threat environment. In practice, IMCIT became a leading RCMP authority on the threat posed by the Freedom Convoy, sharing its reporting on the “strategic intelligence picture” within the RCMP command and with security and intelligence partners in the Federal Government. It took on this role during the Freedom Convoy in a kind of institutional vacuum, and had to stretch its mandate and expertise to do so. There was inevitable duplication with the reporting of the Joint Intelligence Group.

The Public Order Emergency commission was made aware of the function of the IMCIT.  Its series of 9 “Special Threat Advisories”  (STAs), produced between January 25 and Febuary 23, 2022,  were released to POEC and made available on the Commission website. ^[2]  In an interview summary published by POEC regarding IMCIT, the officer responsible for overseeing the unit, Ms. Lisa Ducharme, described the special threat advisories as involving the processing of raw information  to “provide context, relevance and assessments.” Ms. Ducharme characterised the STA’s as “forward looking documents that identify what to expect down the road.” ^[3]

Well, not really.

The question of the adequacy of IMCIT “special threat advisories” as sources of strategic intelligence and their ability to assess trends in the threat picture was not raised in the Project Natterjack report (nor indeed  in the final report of the Public Order Emergency Commission).  

In preparing my own research paper for the Commission in August 2022, prior to its public hearings, I was able to incorporate a discussion of IMCIT reporting based on materials released through the Access to Information Act.  In that study I was critical of the lack of any actionable intelligence stemming from the IMCIT reports. ^[4]

I remain of that view. In practice, IMCIT reporting was of little to no value to decision-makers on its circulation list. It struggled even to make current estimates of the Freedom Convoy and provided little in the way of assessments of possible future developments. Nor was it able to sustain a flow of reporting during the duration of the Freedom Convoy. Its first special threat advisory was published on January 25, only three days before the arrival en masse of convoy protest trucks in Ottawa. IMCIT produced only 8 reports during the period from January 25 to February 16, with one final report on the last day in which the Emergencies Act was in place (February 23). There were frequent gaps in its reporting on what was a very dynamic threat environment: gaps manifest between January 28 and 31, between January 31 and February 3, between February 3 and 10, and finally between February 10 and 16. The latter two gaps came at especially critical moments as the government grappled with how to respond to the occupation of Ottawa and border  blockades and ultimately turned to the use of the Emergencies Act.

And then there is this last mystery about IMCIT’s role. According to an extensive time-line that accompanies the Natterjack report, the National Security and Intelligence Adviser reached out to the RCMP on February 14 for a report on the Freedom Convoy threat, as the Government was finalizing its decision to invoke the Emergencies Act. The task fell to IMCIT which was asked to produce a threat assessment on “the threat of the blockades, the individuals involved, the weapons, motivations, and threats to the national interest and institutions.” The timeline notes that IMCIT “provided an email response to the National Security and Intelligence Advisor's request.” An email response is not, of course, a threat assessment report and it may be that IMCIT was simply unable to prepare a final overview assessment to meet the NSIA’s request. The content of this email was not discussed or commented on in the Natterjack report. That any such email existed was not disclosed at the Public Order Emergency Commission hearings and not mentioned in its final report. Likely POEC was left unaware.

To dive a little more deeply into the deficiencies in IMCIT threat assessments, it is important to note that in its first STA on January 25 it could provide no estimate of the length of time the protest might exist in Ottawa, and no estimates on the number of convoys, vehicles and people descending on Ottawa. This inability persisted until the Freedom Convoy had taken root in Ottawa. (STAs January 25-Jan 28).

IMCIT also struggled to characterize the views of Freedom Convoy protesters, getting no further than suggesting the convoy “includes individuals with a range of views.” On January 31, the IMCIT noted that :

“Factors sch as the circulation of misinformation, exhaustion, substance abuse, altercations among protesters and with law enforcement and the influence of ideologically motivated actors or charismatic speakers may impact the temperature of the crowd…” (STA Jan 31).

This characterisation was repeated, unchanged, on February 3.

The central tenet of the Freedom Convoy protest organisers, who are never mentioned by name in the IMCIT reports, to force the government to rescind all COVID-related public health measures, seems to have largely escaped IMCIT. IMCIT simply ascribed this view to ”some protesters.”(STA Jan. 31)

IMCIT observed with some fascination what it described as an “unprecedented escalation” for the Freedom Convoy protest through the targeting of critical infrastructure at borders.  This was reactive reporting; it was unable to predict such a development. (Feb. 10)

There was, in fact, no “strategic” dimension to these diluted threat assessments and no real actionable intelligence to assist policy makers. The STA picture of the Freedom Convoy was mostly static. The only time the IMCIT STAs were forward looking was in a final assessment produced as the EA was withdrawn, in which it loosely predicted that:

“anti-government and anti-authority grievances have been strengthened as a result of the Freedom Convoy 2022”

and that:

“future public order events are likely to continue targeting critical transportation infrastructure.” (Feb 23)

IMCIT, despite being thrust into the role, simply could not meet the RCMP’s needs for threat assessments on the Freedom Convoy.

If the Project Natterjack report failed to grapple with the inadequacy of RCMP threat assessments, an inherent risk with any purely internal review, it did generate other useful observations based on responses to the questionnaire, and proposed recommendations to fix the problems identified through the survey.

The observations were numerous and are summarised below:

Over-reliance on open-source intelligence

Lack of access to intelligence from front-line officers

Lack of access to intelligence reports from Divisions

Lack of coordination of intelligence reporting

Too many demands for intelligence reporting from multiple entities

Duplication of effort

Absence of intelligence analysis capability for contract and aboriginal policing

Desire of law enforcement partners at provincial and municipal level for a greater role to be played by RCMP in intelligence

Lack of effective governance structure for intelligence at RCMP HQ

That long list was condensed into key recommendations by Assistant Commissioner Slinn.

The most important was to have the RCMP create at national HQ a “Major Event Intelligence Unit” to have a ready capacity that could address many of the access,  coordination, analysis and reporting issues identified by respondents to the Natterjack questionnaire. This unit would fill the gap left by the inability of IMCIT to play such a role.

There was also a worrying reflection captured in questionnaire responses that illuminates problems with the RCMP’s culture of intelligence. Here is a quote from the Natterjack report:

“Interviewees and survey respondents expressed the need to educate intelligence clients on the value of intelligence and how it can be used for decision-making. Interviewees noted that the role of intelligence was not valued during the convoy related events.”

The associated set of recommendations involved enhanced training on the role of intelligence for decision-makers and assigning the proposed Major Events Intelligence Unit to be a centre of expertise for analytical training on public order intelligence analysis.

Weakness in intelligence culture and appreciation of its significance may also have contributed to a dangerous occurrence at the Coutts, Alberta border blockade where front line officers deployed to police the blockade were not made aware of the RCMP’s undercover investigation and arrests of what was alleged to be an armed cell that threatened to kill police officers.

Another key recommendation involved the need to clarify RCMP policy with regard to the use of open source intelligence and internet monitoring. As I noted in my report for POEC, the RCMP has come under significant criticism from the Civilian Review and Complaints Commission for its use of open-source intelligence in responding to public protests. ^[5]  I wrote that an RCMP internal audit had finalised its report on OSINT policy in January 2021. It made some similar recommendations to those contained in Natterjack.  But the status of current OSINT policy and guidance within the RCMP is not publicly known. The recommendation in Natterjack is that:

“the RCMP review and clarify operational policy for information collection in support of operations that does not have a clear nexus to criminality. Such a policy should specify authorities for collection, information storage, consistent use, exchange and retention of information.”

This suggests RCMP OSINT policy remains in flux.

While internal reviews of the kind mounted by Natterjack have their value, their biggest selling point, to compensate for a potential lack of objectivity, spirit of innovation, and restraints on criticism, has to be trust and practicality factors.

Has there been uptake of the Natterjack recommendations? Because the process was internal, any uptake remains internal and escapes the need for transparency and accountability.

In other words, we just don’t know. Let’s hope the intelligence function gets sorted before the next public order emergency. Let’s hope the RCMP, a law enforcement agency devoted to the mantra of “intelligence-led policing,” can build an intelligence culture, which requires both high-quality intelligence reporting and receptivity to that reporting.

---

^[1] Jim Bronskill, The Canadian Press, “Officers weren’t told of threats to harm police, says RCMP report on 2022 convoy protests, March 9, 2024, https://www.theglobeandmail.com/canada/article-officers-werent-told-of-threats-to-harm-police-says-rcmp-report-on/

^[2] The document reference numbers are as follows: PB.NSC.CAN.00000520-PB.NSC.CAN.00000526; PB.NSC.CAN.00000536-PB.NSC.CAN.00000537; PB.NSC.CAN.00000527. The doc numbers can be used to go to the individual reports on the Commission website at: https://publicorderemergencycommission.ca/documents/presentations-overview-reports-and-exhibits/

^[3] POEC interview summary: Lisa Ducharme and Nathalie Vinette, RCMP, document number WTS 00000067, https://publicorderemergencycommission.ca/documents/presentations-overview-reports-and-exhibits/

^[4] Wesley Wark, “The Role of Intelligence in Public Order Emergencies,” https://publicorderemergencycommission.ca/files/documents/Policy-Papers/The-Role-of-Intelligence-in-Public-Order-Emergencies-Wark.pdf

^[5] Ibid.