Threat Intelligence Blog

Posted August 7, 2015

Author: Hans Mathias Moeller, Senior Intelligence Analyst

In today’s post, we review our recent assessment of potential physical security threats to the Toronto Pan Am Games. While the Games concluded peacefully, there are insights to be gained from the event that can help companies operating in this region be better prepared for future risks.

One of the challenges cyber threat analysts face is making accurate assessments of physical and digital risks for events, organizations, and individuals based on information gathered from open source intelligence (OSINT). Although there are many software solutions that collect and deliver data from social media and web monitoring, our view is that there’s a big difference between “threat intelligence” and “data,” and in order for organizations to make informed decisions, human analysis of potential threats in context is critical for identifying what (or who) is relevant to a situation or not. As part of that process, it’s also helpful to review such assessments after the fact to better guide future forecasts.

In our report, Toronto Pan American Games 2015 – Assessment of the Physical Threat Environment, we discussed possible physical security threats to the Games, which were held July 10—26, as well as short and medium-term threats to companies operating in the Greater Toronto Area. These threats included domestic and international terrorism, protests and social unrest, and natural hazards, among others.

While the event concluded with no major incidents, there are valuable insights we can gain from our analysis to help companies in this region maintain situational awareness and understand potential physical threats in the environment. With this in mind, let’s take a look at our original predictions regarding the Games, versus what actually happened.


Assessment: In our report, we noted that the Pan Am Games was an attractive and vulnerable target for various terrorist organizations. Self-radicalized Canadians, inspired by terrorist groups based in the Middle East and Africa, were specifically mentioned as a possible threat. This assessment was based on statements released in recent months by international terrorists calling for attacks against the country, as well as Canada’s growing military commitments against terrorism overseas, both of which have made the country vulnerable to potential retaliations.

Results: No terrorist attacks took place, and no known attacks were foiled.

Protests and Social Unrest

Assessment: We predicted that the Games would be an attractive platform for groups seeking to gain media attention by staging protests near the Games’ sites. We emphasized a recurring trend of protests outside foreign consulates against specific policies and events, specifically mentioning the U.S. Consulate. We also anticipated possible transportation disruptions due to growing resentment from taxi drivers against the Uber ride-sharing application.

Results: Overall, our analysis of the physical protest environment was accurate, as a dozen protests occurred during the Games. Protest activity included non-violent demonstrations against mining companies, housing shortages, and budget cuts; a pro-Palestinian protest outside the U.S. Consulate, along with a counter protest by an opposing group; and others.

A taxi driver protest, which was scheduled for July 8, could have very well spilled into the Games, but it was cancelled after talks between Uber representatives, Toronto taxi drivers, and the Mayor of Toronto.

Natural Hazards and Crime

Assessment: Extreme weather is difficult to forecast, but we felt it was important to stress that extreme weather needs to be monitored as it has become more frequent, with two flooding disasters occurring in Toronto within the last three years. We predicted that due to the large influx of tourists and visitors, crimes of opportunity, such as pickpocketing and theft, would no doubt increase.

Results: There were no extreme weather events during the Pan Am Games. Statistics specifically for crime during the Pan Am Games is not available, but there were several instances reported of theft of professional high-end cameras.

Post-Pan Am Games Outlook

Terrorism: Both domestic and international terrorism remain a threat to Canada. The main threat originates from terrorist networks that use the web and social media to incite and radicalize susceptible Canadians to commit attacks within the country. These terrorist networks are expected to continue to encourage “stay and act in place” attacks against western countries.

Macro-terrorism events that cause significant property damage, fatalities, and injuries are not impossible, but unlikely. Local sympathizers are often constrained by limited capabilities and lack of sophistication due to a weak network of supporters who can provide logistics, training, and finances. Local supporters in Canada are also restrained due to reactive Canadian counterterrorism measures, particularly the adoption of anti-terrorism legislation.

In particular, energy companies should be alert to possible radicalization among environmental and aboriginal people who believe these companies are exploiting the environment and violating indigenous land.

Protests and Social Unrest: Protest activities by Aboriginal Canadians, as well as environmental and anti-capitalist groups, will continue for the foreseeable future. These social issues have deep historical roots and broad grassroots support in Canada, and these groups enjoy logistical and financial backing to sustain their campaigns.

Dynamic protests (moving processions) are expected to continue to be an attractive protest tactic for groups seeking to garner media attention. Dynamic protests mixed with non-violent direct actions (sit-ins, die-ins, occupation, and obstruction) are also likely in an effort to maximize publicity.

Static (non-moving) protests outside foreign consulates in Toronto are also expected to continue. Large immigrant diaspora communities in Toronto include groups that have strong emotional connections with their former home countries, or those who are stateless.  These groups are anticipated to stage protests outside consulates in an attempt to affect decision makers and policies in both home and host country.

Taxi driver protests against Uber are anticipated to occur in the near future, especially if Toronto taxi drivers lose the $300 million lawsuit and injunction filed against Uber around the time of the Games. This may result in localized area disruptions in downtown Toronto and increased probability of taxi strikes.

Natural Hazards: Extreme weather is six times as common in Canada compared to 40 years ago. Flooding can disrupt business operations due to power outages, stranded commuters, and washed away roads. Extreme weather is unpredictable, but should not be discounted by businesses in Toronto and the Ontario region.


Companies operating in the Greater Toronto Area need to be cognizant of potential physical threats to ensure the safety of employees.

We advise businesses to put together an assessment of all company buildings and surrounding areas, including sites and buildings nearby that could be targeted by social movements and potential terrorists. It’s easy to forget that even though a protest may not be related directly to your company or industry, it can still pose as a threat to employees. Businesses should review and tighten visitor procedures, including egress and access controls, and ask employees to be more vigilant and observant of any unusual behavior and suspicious visitor activity.

Businesses should also have updated and proper contingency plans in place, which should be practiced on a regular basis to maintain high levels of readiness. Employees should be aware of evacuation and invacuation procedures, as well as scenarios involving shelter-in-place and active shooters.

Being proactive with your physical safety plan is one of the best preventative measures to keeping your business safe. Companies should regularly review resilience plans and responses to potential incidents, whether they be terrorist situations, extreme weather, or protest activity.

Cyveillance’s Special Investigations Unit (SIU) conducts a variety of investigations. Contact us to learn more about our Executive Security Solutions to help physical security, protection, and investigation professionals detect and assess threats to high-profile public or private individuals, or to request special reports for events.

Additional Posts

Cyveillance Weekly Phishing Report: August 10, 2015

  Phishing Report: Top Targets Week of August 2 - 8, 2015 Author: Robert McDaniel   In ...

Defining the Need for Threat Intelligence, Part 1

Author: Eric Olson, VP of Product Strategy In this four-part Executive Leadership series on making ...