The final week of public hearings as part of the Public Order Emergency Commission's inquiry into the "Freedom Convoy" protests kicked off on Monday with testimony from a panel of the highest-level security and intelligence officials in the country.

During their appearance, Canadian Security Intelligence Service (CSIS) Director David Vigneault, CSIS Deputy Director of Operations Michelle Tessier, and Integrated Terrorism Assessment Centre's Executive Director Marie-Helene Chayer discussed the evolving understanding of what constitutes a national security threat.

The panel also spoke about the kind of monitoring of ideologically-motivated violent extremism (IMVE) risks they conducted in connection to the convoy, and indicated that given how the world has evolved since the CSIS Act was enacted in 1984–four years before the Emergencies Act became law–it may be time for some modernizing. 

Given the sensitive nature of their work, some of their testimony previously took place in camera. But, during their hours of public testimony, one major revelation came: despite previous warnings about not meeting a certain national security threat threshold, CSIS ultimately advised the federal government that bringing the "Freedom Convoy" protests to an end required unprecedented powers.

Following this panel on Monday was the first of key political witnesses to take the stand: Emergency Preparedness Minister Bill Blair.

Here are the key takeaways from Monday's CSIS-focused testimony.

DESPITE CSIS 'NATIONAL SECURITY' THRESHOLD, ACT NEEDED

During Monday's testimony, the biggest revelation from the CSIS panel was when the commission heard that agency director Vigneault told Prime Minister Justin Trudeau on Feb. 13 that invocation of the Emergencies Act “was indeed required.”

This came as he sought to put more context around a warning he made in the days leading up to the invocation of the Emergencies Act—which the commission had already learned about—that in his assessment, "there did not exist a threat to the security of Canada as defined by the service’s legal mandate."

This one line has become a key fixation at the convoy commission. It has prompted a series of questions to recent federal witnesses about the discrepancy between CSIS' guidance, and Trudeau declaring a national public order emergency, defined in the Emergencies Act as “an emergency that arises from threats to the security of Canada."

The wording "threats to the security of Canada" has the meaning assigned to it by 'section 2' of the CSIS Act, which is much more limited in its scope— mainly espionage or sabotage, foreign influenced activity, ideologically-motivated violent extremism (IMVE), terrorism— than the broader consideration of national security threats considered by the federal government in invoking the Act.

On Monday, Vigneault testified that he agreed with other top federal officials that the 'section 2' definition of the threat to the security of Canada is in need of modernization, given it was put into law nearly 40 years ago. This backs up the testimony from National Security and Intelligence Adviser Jody Thomas and Privy Council Clerk Janice Charette.

He said that while CSIS did not believe the "Freedom Convoy" posed a threat to national security under the grounds of the CSIS Act, that standard was only for CSIS' requirement to open new investigations.

Once he learned that the Emergencies Act was relying on the same definition, he came to understand after conferring with the Department of Justice that the legal interpretation was different. And, that when the broader context of what was going on with the protests was considered, based on his everything he had seen to that point, the extraordinary powers were needed and he communicated as much to the decision-makers.

This revelation was teased out during the public hearing, but came first in his in-camera testimony. When a commission lawyer asked Vigneault to confirm and expand on what he told the commission behind closed doors, here's what he said, in part.

"I was assured that you know, there was a separate understanding… The confines of the CSIS Act, the same words, based on legal interpretation, jurisprudence, federal court rulings, and so on, there was a very clear understanding of what those words meant in the confines of the CSIS Act. And what I was reassured by, is that there was you know, in the context of the Emergencies Act, there was to be a separate interpretation based on the confines of that Act."

Seeking to clarify further, a commission lawyer then asked: "If I'm understanding the way you've put those two together, that if you take a broader definition, and then look more broadly, you come up with the advice you gave to the prime minister of your belief that it was required to invoke the Act?"

"Yes, that's it. That's exactly it," Vigneault replied, going on to suggest it's time for an update to the CSIS Act.

50 PER CENT OF CSIS RESOURCES FOCUSED ON IMVE

In another portion of the summary of the CSIS witnesses' ex-parte hearing detailing how CSIS investigates IMVE, "a significant increase" in the agency's investigative activity due to the rise of IMVE and the effects of the pandemic was revealed. Specifically, approximately 50 per cent of CSIS' counterterrorism resources are now devoted to handling this kind of threat.

"The COVID-19 pandemic exacerbated xenophobic and anti-authority narratives leading to the rise of conspiracy theories, misinformation, and disinformation online," reads the summary, in part.

Describing their approach to IMVE as a "funnel," CSIS testified that the wide range of "awful, but lawful" extreme views would be at the top of that funnel, and the scope of activity that would prompt an investigation such as planning to act on it, would be the narrow bottom of that funnel.

Citing recent examples of ideologically-motivated mass killings in Canada, Tessier said that as they’ve seen an increase, they’ve reallocated their resources to “investigate what we see as a very significant and growing threat.”

Tessier testified that it can be "a challenge to know when somebody is going to move from the online space to the physical space."

"It's often not necessarily the person posting the rhetoric, but the person consuming it who can decide to become radicalized and then act," she said.

CSIS told the commission that throughout the protests the overall threat level in Canada remained at “medium.”

'STORMING' THE HILL AND EXTREMIST FLAG INTEL

Relatedly, the commission learned on Monday that in late January—prior to the convoy's arrival in Ottawa—CSIS wrote an assessment for Public Safety Minister Marco Mendicino about the protest that flagged online chatter about "storming Parliament Hill buildings” and the potential attendance of extremist actors.

The briefing also warned that while the organizers intended to have a peaceful protest, "there are indications" that IMVE actors who were part of the anti-public health measures movement had "expressed interest in attending in Ottawa to support the convoy," and the event presented an opportunity for those inspired by IMVE to "engage in threat activities."

"We had already an awareness of a number of individuals in Canada who were engaged activities that met our threshold for [section 2c] investigations. And so we were aware, that some of these individuals were interested in paying a lot of close interest to the convoy and trying to understand you know, what it meant," Vigneault said, adding that they were looking to see if there would be any lone-actor threats during the demonstrations.

It also noted that at that time, CSIS was unaware of "any tangible plots or plans of serious violence."

Asked to speak to this, Vigneault said there was no risk they were aware of at the time.

"What I think is very important to remember in this event and other events of the sort that we've seen in the U.S. and other democracies, is that there could be a very quick turn of events. You know, there could be very quick radicalization, or shift in the dynamic," he said.

Then, in an early February briefing—labelled secret but declassified for the commission— focused on "the imagery and significance of flags," the agency noted that while CSIS said there was a small number of flags that "reflected racist and bigoted worldviews," they still posed "a threat to the fabric of Canadian society."

Citing Nazi, ‘Don’t Tread On Me’ and Confederate flags as examples, CSIS said that while the presence of flags linked to extreme groups was "not necessarily a reflection of group membership of the bearer, they could be being used to make it appear their cause or belief was more organized or widespread than it actually is.

As for the prevalence of Canadian flags at the protests, CSIS interpreted that as an indication of patriotism, suggesting that those waving the Canadian flag upside down were "likely an indication of the bearer’s belief that nation is in distress."