Canada Privacy Law Hampered Intelligence Sharing

A man identified by Canadian police as Michael Zehaf-Bibeau is seen Oct. 22 as he runs toward Parliament buildings in a still image taken from surveillance video. Reuters TV

WASHINGTON—Neither of the two Canadian men who attacked soldiers and Parliament this week were on a terror watch list in the U.S.—one because of privacy laws in Canada—raising concerns among American officials about possible intelligence gaps close to home.

On Monday, Martin Rouleau used his car to strike and kill one Canadian soldier and injure another outside Montreal, before being killed by police. On Wednesday, Michael Zehaf-Bibeau used a rifle to kill a soldier in Ottawa, then stormed Parliament where he died from shots fired by security personnel, including the sergeant-at-arms.

Neither were marked in U.S. databases of security threats, according to a person familiar with the investigation.

In Mr. Rouleau’s case, that was especially alarming because Canadian authorities say they had taken away his passport and put him on a watch list because he had attempted to travel to Syria to join fighting there.

But his name wasn’t shared with the U.S. because court rulings in recent privacy cases in Canada have limited the ability of officials to share certain kinds of information about Canadians with foreign governments, according to a Canadian government official.

The Canadian government has signaled plans to update the laws governing the Canadian Security Intelligence Service, the country’s main spy agency, and that the changes to the law would make it easier to share this information.

Canadian investigators say Mr. Zehaf-Bibeau didn’t have a passport, but had come to Ottawa in the hopes of getting one so he could travel to Syria. Canadian officials have said that while they were aware of Mr. Zehaf-Bibeau, he wasn’t on their watch list.

Both incidents underscore a security concern of U.S. and Western counterterrorism officials: These types of one-off, homegrown attacks are far more difficult to detect than bigger, long-term conspiracies—and they may grow with the increasing media prominence of the extremist group Islamic State.

One U.S. counterterrorism official said that Islamic State is “potentially changing the threat landscape” through its use of social media. “As its message reaches a broader audience, the possibility goes up that more people with extremist views could be influenced to act out violently,” the official said.

It isn’t clear, however, whether Islamic State militants are intentionally pursuing a smaller-scale strategy or if they are just encouraging others to mount what are likely to be more limited attacks.

“It may be all they’re capable of doing at the moment,” said Rep. Adam Schiff, (D., Calif.), a member of the House intelligence committee.

“It doesn’t take much to create a lot of mayhem,” he added.

The Royal Canadian Mounted Police say they are currently monitoring about 90 individuals in Canada who may be trying to join up with foreign terror groups.

The RCMP declined to comment. A spokeswoman for the Canadian Security Intelligence Service didn’t return a call seeking comment.

Investigators were still scouring the online activity of Mr. Zehaf-Bibeau, but currently believe he wasn’t acting at the direction of any radical group, though he may have been inspired at some level by Islamic State.

U.S. officials see these kinds of lone-wolf attacks becoming a hallmark of the influence of Islamic State, also known by the acronyms ISIS and ISIL. They represent a marked step back from the large-scale ambitions of al Qaeda, from whom the group split earlier this year, but are nearly as worrisome, given the panic they can provoke.

Islamic State militants have encouraged attacks of all types—and set a low threshold for what constitutes a success.

“Given ISIS’s prominence in the radical sphere, it seems quite concerning as a trend,” said Matthew Olsen, who stepped down last month as director of the National Counterterrorism Center.

Officials have long warned of the potential for homegrown attacks, and al Qaeda and its offshoots have called for them, including al Qaeda’s Yemeni branch that has published homemade bomb-making recipes.

Mr. Olsen’s successor at the counterterrorism center, Nick Rasmussen, told Congress last month that such attacks are “the most likely immediate threat to the homeland.”

He said he expects homegrown terrorist plotting “to remain the same over the course of the next year,” meaning “a handful of uncoordinated and mostly unsophisticated plots emanating from a poll of up to a few hundred individuals.”

These one-off attacks have occurred infrequently. The most recent involved last year’s bombings in Boston, which intelligence officials believe was inspired in part by al Qaeda’s Yemeni branch. Before that, U.S. Army Maj. Nidal Hasan killed 13 people at Fort Hood in Texas in 2009.

Most U.S. counterterrorism programs are geared toward detecting an overseas threat and disrupting it either with a drone strike or some other countermeasure before the plotting reaches a point where it crosses into the U.S. Fewer programs aim to detect threats in the U.S.

“The tools needed to effectively confront these incidents are very different from the tools we have used in the past,” said John Cohen, who recently stepped down as the top counterterrorism at the Department of Homeland Security and is now with Rutgers University.

Mr. Schiff said he believes that if Islamic State is able to hold territory in Syria or Iraq for an extended period and can establish a haven, it could seek to direct larger attacks.