What Is CSIS Still Hiding? The Intelligence Operations Behind the Secrecy

Underlying action: Equibit Group Ltd. v. Attorney General of Canada et al., Ontario Superior Court of Justice, Court File No. CV-20-00645492-0000. Federal Court: Attorney General of Canada v. Equibit Group Ltd. et al., File No. DES-14-26. Access to information: CSIS request 117-2020-201, OIC file 5820-01949.

When CSIS defended its refusal to release cryptocurrency records to Equibit Group, it told the Information Commissioner that disclosure could “reveal the identities of CSIS covert employees and harm the conduct of ongoing investigations and intelligence operations.” Five months later, the Attorney General of Canada asked the Federal Court to keep information in the production in Equibit’s lawsuit secret under section 38 of the Canada Evidence Act, at a hearing held ex parte and in camera.

This post sets out Equibit Group’s position on what those CSIS intelligence operations could be, measured against the events Equibit has documented, and why the courts need to order production of what CSIS and the Attorney General are holding back. The powers in the CSIS Act fit those events. The target does not: advocating sound money and limited government is not a threat to the security of Canada.

What follows is Equibit Group’s analysis and its position on the record. The claims in Equibit’s pleadings are allegations, and each inference below points to the document or published post it rests on. None of them has been determined by a court.

What CSIS Told the Information Commissioner

On August 25, 2020, thirteen days after Equibit filed its Statement of Claim, Chris Horlacher asked CSIS for its intelligence reports and executive briefing notes concerning “blockchain” or “cryptocurrency” from September 1, 2015 to August 24, 2020, a window that covers Equibit’s entire operating life. CSIS released little. A complaint went to the Office of the Information Commissioner (OIC).

The OIC’s final report of April 15, 2026 found the complaint well founded: CSIS had improperly withheld information, and it conceded the point by issuing a supplementary release on March 3, 2026. For the rest, the OIC accepted CSIS’s exemptions. CSIS’s stated reasons, as recorded in the report, are the clearest public description of what sits behind the redactions:

• Foreign sources (s. 13(1), p. 2). The withheld information “was obtained in confidence from a foreign state and/or an international organization of states.”
• International affairs (s. 15(1), p. 3). CSIS said disclosure “could irreparably damage ongoing investigations as well as relations with foreign governments and agencies.”
• Techniques (s. 16(1)(b), p. 5). Disclosure “could reveal investigative techniques, tradecraft and plans” and “could reasonably be expected to harm ongoing investigations.”
• Covert personnel (s. 16(1)(c), p. 7). Disclosure “could reasonably be expected to reveal the identities of CSIS covert employees and harm the conduct of ongoing investigations and intelligence operations.”
• Other individuals (s. 19(1), p. 8). Personal information about individuals other than the requester.

The report does not say whom those investigations concern, and the OIC’s acceptance of an exemption under the Access to Information Act is not a finding about Equibit. What the report does establish is that, in 2026, CSIS was still claiming that cryptocurrency records from 2015 to 2020 involve foreign partners, tradecraft, and covert employees whose exposure would harm the conduct of ongoing investigations and intelligence operations.

Said One Thing, Did Another

CSIS and the Attorney General have pled one thing, then done the opposite, again and again. The starkest example is section 38 of the Canada Evidence Act. In July 2025 the Crown told Equibit that going to the Federal Court under section 38 to protect CSIS information was not worth it. Fourteen months later, it went to the Federal Court under section 38 to protect information in the production in Equibit’s lawsuit.

In this case, given that the time and expense needed to protect this information – including potentially through an application to the Federal Court pursuant to section 38 of the CAE – is out of proportion to the costs of defending the action, an exception is being made.

Department of Justice letter to Equibit’s counsel, July 25, 2025, p. 1

On April 7, 2026, the AGC received notice under ss. 38.01(3) of the CEA, stating that documents required to be disclosed in the Underlying Proceeding may contain sensitive or potentially injurious information … Disclosure of the information subject to this Application would be injurious to national security

Attorney General’s Amended Notice of Application, DES-14-26, grounds (b) and (d), made public by order of Justice Kane, September 18, 2026

Set each of the Crown’s statements beside what came next:

What the Crown said	What happened next
January 19, 2021. The Attorney General advised Equibit that “CSIS has no knowledge of the acts alleged in the statement of claim” (Statement of Defence, para. 8).	April 15, 2026. CSIS told the Information Commissioner that releasing its 2015–2020 cryptocurrency records, a window covering Equibit’s whole operating life, “could reasonably be expected to reveal the identities of CSIS covert employees and harm the conduct of ongoing investigations and intelligence operations” (OIC final report, p. 7). The OIC also found CSIS had improperly withheld information, which CSIS conceded with a March 3, 2026 release (pp. 1, 9).
October 1, 2021. The Statement of Defence: “CSIS did not engage in the acts alleged in the statement of claim attributed to ‘the CSIS defendants’” (para. 7). July 25, 2025: CSIS’s witness would confirm “that CSIS had nor has any involvement in the facts of this case” (letter, p. 1).	September 16, 2026. After CSIS’s witness confirmed the opposite in discovery, the Attorney General told the Federal Court that disclosing information in the production in this very action “would be injurious to national security” and that “an ex parte in camera hearing is necessary” (Amended Notice of Application, ground (d); representation (f)).
July 25, 2025. The Crown’s position was “reflected in its List of Documents listing no documents” (letter, p. 1).	April 7, 2026. The Attorney General received notice that “documents required to be disclosed in the Underlying Proceeding may contain sensitive or potentially injurious information,” then refused to authorize disclosure of “some of the information redacted in the documents covered by the notice” (Amended Notice of Application, grounds (b) and (c)).
July 25, 2025. Protecting the information through a section 38 application was “out of proportion to the costs of defending the action,” so “an exception is being made.” The letter called it “extraordinary for CSIS to be this transparent” (letter, p. 1).	September 16, 2026. The Attorney General brought the section 38 application, asked to argue it ex parte and in camera, and warned that further section 38 notices “covering additional documents” may follow (ground (f)). Justice Kane ordered the amended application made public on September 18, 2026, and provided that further documents can be added to it (order, para. 4).

A party with a List of Documents “listing no documents” does not need the Federal Court to protect documents. Equibit Group’s position is that the s. 38 notice proves the Crown holds relevant records it did not list, and that those records contain information the Crown itself considers sensitive to national security.

Equibit Group’s position is that the Crown’s next move was worse than a paper flip. Years of counterintelligence and legal pressure had forced Marc Godard, the CSIS officer embedded in Equibit, into the open. On August 18, 2025, Equibit delivered a written ultimatum to the Attorney General of Canada: cease the conduct, keep Godard’s name out of the media, and settle the way CSIS has settled before — quietly, under NDA. The Attorney General ignored the letter. Equibit’s position is that the Crown chose a public spectacle instead, and then ran to the Federal Court under section 38 to bury the production. The letter is at An Ultimatum to the Attorney General of Canada.

A Constant Retreat

Each position lasted only until the record caught up with it. First the Crown said CSIS knew nothing. When the case reached discovery, that denial became a List of Documents listing nothing, carried into the examination by a CSIS officer. When documents had to be disclosed, “no documents” gave way to a section 38 notice. And the promise that a section 38 application was out of proportion gave way to exactly that application, with a request to argue it in private. The Crown has never explained a single one of these shifts. It simply moves to the next position when the last one collapses.

Equibit Group’s position is that a litigant that retreats like this has spent its credibility. That matters most where the court has nothing but the litigant’s word. In an ex parte hearing, the evidence “must be complete and thorough and no relevant information adverse to the interest of that party may be withheld” (Ruby v. Canada (Solicitor General), 2002 SCC 75, para. 27). The Federal Court has said that in CSIS warrant matters “designated judges have no choice but to rely on compliance with the duty of candour,” and that CSIS’s own breach had a “corrosive effect” on “the Court’s confidence in the Service’s ability to be candid” (2020 FC 616, paras. 90, 92). The same judgment recalls that “the Attorney General is not an ordinary party” (para. 88, quoting 2013 SCC 43, para. 37). A party whose public positions have fallen one after another cannot ask the Federal Court to accept its private assertions on faith. They must be tested, by a court that has the records in front of it and by an amicus who can argue the other side.

What the Retreat Protects

Why would a government give up position after position rather than simply produce the records? If the records showed nothing, production would end this case. Equibit Group’s inference is that the production would reveal not a single investigation but a sustained covert disruption campaign: a modern Zersetzung. The Stasi Records Archive describes Zersetzung as the East German Ministry for State Security’s method of covertly fighting people it deemed “hostile-negative.” Under Directive 1/76, the aim was to fragment, paralyse, disorganise and isolate them. Against individuals it prescribed the “systematic discrediting” of their reputation and the “systematic organisation of professional and social failures” to undermine their self-confidence. It often worked through a combination of measures in a longer-running operation, and it served as a substitute for prosecution when open arrest was politically inconvenient.

Set that beside the eight candidate operations above. The hacking and the 2018 approach to Equibit’s developers went after the work itself. The takeover attempt went after control of the company and its lawsuits. The fake websites and toxic backlinks went after reputation. The debankings and the TD email went after money. The strange calls and the network probes kept up the pressure. Equibit Group’s position is that, together, they read like a Zersetzung plan, and that section 12.1 of the CSIS Act, with the measures listed in section 21.1(1.1), now lets a Canadian agency carry out disruption of exactly this kind, with a Federal Court warrant where a measure would break the law or limit a Charter right, once the target is labelled a threat to the security of Canada. That combined record, and the threat assessment behind it, is precisely what the section 38 application and the Crown’s retreat would keep out of sight. That is why the Federal Court, with an amicus at its side, must see it.

This section is Equibit Group’s inference and position. It is speculation about what the withheld records contain, and none of it has been determined by a court.

What Counts as an “Intelligence Operation”?

The CSIS Act gives CSIS two kinds of operational power. Under section 12 it collects intelligence “by investigation or otherwise.” Under section 12.1, added in 2015, it may “take measures, within or outside Canada, to reduce the threat” when it believes an activity threatens the security of Canada. Measures that would break Canadian law or limit a Charter right need a Federal Court warrant under section 21.1, which lists what such measures can include:

• “altering, removing, replacing, destroying, disrupting or degrading a communication or means of communication” (para. (a));
• “altering, removing, replacing, destroying, degrading or providing — or interfering with the use or delivery of — any thing or part of a thing, including records, documents, goods, components and equipment” (para. (b));
• “fabricating or disseminating any information, record or document” (para. (c));
• “making or attempting to make, directly or indirectly, any financial transaction” (para. (d));
• “interrupting or redirecting, directly or indirectly, any financial transaction that involves currency or a monetary instrument” (para. (e)); and
• “personating a person, other than a police officer,” in order to take any of those measures (s. 21.1(1.1)(g)).

Section 12.2 sets hard limits. Among other things, CSIS may not “wilfully attempt in any manner to obstruct, pervert or defeat the course of justice.” Every measure taken must be reported to the National Security and Intelligence Review Agency (s. 12.1(3.5)), so a written record exists for each one.

Equibit has documented events that fall within each of those statutory categories. Below are eight candidate operations. For each, Equibit Group’s position is that it is a possibility consistent with the covert intelligence operations CSIS described to the OIC. Fitting a statutory category is not proof that CSIS carried it out. That is exactly why the records need to be produced.

1. The Hacking: Destruction and Compromise of Equibit’s Code and Systems

The record. Equibit’s Statement of Claim pleads that its lead developer stopped updating the Core Code on Equibit’s repository around July 20, 2018, that other developers found code missing from the version he supplied, and that on resigning on August 13, 2018 he said he had lost the Core Code and returned his laptop reset to factory settings (paras. 19–21). It pleads that the CSIS Defendants misappropriated or destroyed the Core Code (paras. 25, 37–38). The 2019 mainnet collapse and the forking of Equibit’s code are pleaded in CV-21-00654929-0000 and set out in The Assassination of Equibit: Phase Two.

The compromises continued. Seven Documented Technical Attacks collects them: router compromises in July and August 2025 with logs reset to 1981 (analyst reports: Huawei, ZTE); DNS interception documented in an expert report dated August 18, 2025; and the July 13, 2026 intrusion of this website. The claim against Marc Godard pleads unauthorized access to Chris Horlacher’s computers, home network and online accounts, including privileged communications about Equibit’s litigation (para. 6(a)).

Why it fits. Destroying or degrading code, records and equipment, and disrupting communications, are paragraphs (a) and (b) of section 21.1(1.1). Interception and covert access are what section 21 warrants authorize. The 2025 router and DNS events cluster in July and August 2025, the same weeks CSIS was preparing for and attending its examination for discovery.

These are allegations, and attribution of the technical events is Equibit Group’s position. None of it has been determined by a court.

2. The Hostile Takeover Attempt

The record. The Statement of Claim in CV-26-00015305-0000 pleads that Marc Godard purported to convene shareholder meetings of Equibit in July and August 2025 without power, notice, quorum or any shareholder present, and purported to pass resolutions terminating Chris Horlacher’s authority (paras. 6 and 60–71). On or about July 30, 2025, Godard emailed Equibit’s counsel of record, “purported to appoint himself the sole legal liaison for Equibit, demanded the immediate termination of all proceedings against Saucier, and purported to prohibit the commencement of any further proceedings for defamation” (para. 65). The proceedings against Saucier are Equibit’s action against Christian Saucier, David McFadzean and others, CV-21-00654929-0000, in which Godard is himself a named plaintiff (paras. 4 and 45). The claim pleads that the email was “an attempt to displace Horlacher in that role and to arrogate to himself the conduct of Equibit’s litigation” (para. 67). That litigation includes the CSIS action, CV-20-00645492-0000 (para. 4). A notice Godard issued on or about September 21, 2025 proposed to remove Horlacher, to appoint Godard “to act as Equibit’s authorized representative in all legal communications, including instructing Equibit’s counsel of record,” and to “discontinue, withdraw or settle the proceeding commenced by Equibit against Saucier and David McFadzean” (paras. 72–73). The background is in Statement of Claim Filed Against Marc Godard and The Marc Godard Revelation.

Why it fits. The stated aim of the takeover attempt was to end the action against Christian Saucier. Its mechanism would have ended the CSIS action as well. The Godard claim pleads that the prosecution of both actions “has relied entirely on financing from Horlacher, either personally or on behalf of Equibit,” in excess of $230,000, and that Godard “has never contributed any funds toward the prosecution of either of the Related Proceedings, nor toward the operations of Equibit” (paras. 47–48). Equibit itself has no assets and no revenues (para. 31). Oust Horlacher, and no one is left to pay the lawyers. Install Godard as sole legal liaison, and the only person instructing counsel in the CSIS action is a man who has never paid a dollar toward it. The CSIS lawsuit then dies for want of funding, with no motion, no ruling and no notice of discontinuance on the record. Control of counsel plus the removal of the sole funder achieves exactly what a discontinuance would, without anyone having to file one.

Godard made that move on July 30, 2025, inside the July and August 2025 window in which examinations for discovery were scheduled (para. 49), the same window as CSIS’s examination for discovery. Purported resolutions and notices of meeting are documents of the kind section 21.1(1.1)(c) covers. Ending a lawsuit against CSIS from inside the plaintiff, while CSIS is being examined, is the kind of measure section 12.2(1)(b) forbids, because it obstructs the course of justice. Equibit Group alleges that Godard acted for interests adverse to Equibit; Equibit Group’s position is that if any part of the CSIS production touches the takeover attempt, the court must see it.

The claim against Marc Godard is unproven. He has not filed a defence, and nothing in it has been determined by a court.

3. The Fake Websites and Toxic Backlinks

The record. Two impersonation sites used Equibit’s name and branding: equibit.io, which displayed Chris Horlacher’s likeness and called him its chief executive until NameCheap suspended it in January 2023, and equibit.net, activated in or about April 2026, which claimed to be published by a non-existent “Equibit, Inc.” that was “Licensed and Regulated” (Six Key Facts About the Impersonation Websites). The claim in CV-26-00017856-0000 pleads that the operator “procured for that website the first position in search results for Equibit’s own name” and blocked archiving (para. 5(d)). Independent backlink audits found this site’s top referring anchors dominated by casino, cryptocurrency and link-network spam (SEO Poisoning).

Why it fits. Fabricating and disseminating information, and impersonating a person, are paragraphs (c) and (g) of section 21.1(1.1). equibit.net went live in the same month the Attorney General received the s. 38 notice (April 7, 2026) and the OIC issued its final report (April 15, 2026). WHOIS history shows that equibit.net was first registered through NameCheap on March 20, 2017. Its current registration, through Cloudflare, dates from January 26, 2026 (registry record). Its cloned content was first archived on April 11, 2026 (Wosnack claim, para. 39(c)), seventeen days after equibitlawsuit.com was registered on March 25, 2026 (registry record). The clone went live within weeks of Equibit’s own documentation site. The Wosnack claim pleads that Nathan Wosnack and Ubitquity, LLC are responsible. Equibit Group’s position is that this does not answer whether anyone else directed or assisted the operation, and that the CSIS production is where that question gets answered.

These are allegations in a claim that has not been tried. Nothing about the websites has been determined by a court.

4. The Debankings

The record: Revolut. Revolut’s support transcript records how it handled the freeze of Chris Horlacher’s accounts in early 2026 (background: De-Banking and Institutional Pressure). Incoming transfers had been rejected since January 4, 2026, with no notice and no request for information. On February 4, 2026, a Revolut support agent told Horlacher only that the account was “currently being reviewed by the team,” that the review would take “approximately 4 calendar days,” and that “As a regulated provider, we follow standard requirements that can occasionally affect account functionality. Some features are temporarily limited while a standard review is in progress, due to which you are unable to receive any funds into your account.” When Horlacher pointed out that his incoming transfers had been blocked for a month, a second Revolut support agent answered the same day: “because we are a regulated financial institution, we are required by law to perform these thorough security check.” Revolut named no transaction, no term and no document it needed from him.

The record: Wise. From June to October 2026 Wise deactivated a decade-old profile within minutes of new profiles opening, restricted the new accounts within an hour of an address update its own support had requested, and declined to produce the records it relied on (De-Banked Again). Wise told Horlacher that he had repeatedly broken its terms, on accounts he had not yet used or had never used against those terms. No customer transaction was ever made on the profiles; the only movement Wise flagged was its own $31 account-opening fee. In its letters of August 19, October 5 and October 19, 2026, Wise cited the accuracy and acceptable-use sections of its customer agreements without saying what information was inaccurate or what use was prohibited. When Horlacher demanded an explanation, Wise told him that laws prevent it from explaining the details. Its October 19, 2026 letter says that, as a regulated financial institution, Wise is “legally and operationally restricted from disclosing the specific internal records, system flags, or exact verification outcomes that result in an account deactivation.” The letter names no statute, regulation or regulator, and states that Wise “will not be providing further internal operational data or verification records.”

Why it fits. “Interrupting or redirecting, directly or indirectly, any financial transaction” is paragraph (e) of section 21.1(1.1). Since 2024 the CSIS Act has also let CSIS obtain court orders compelling a business to produce records, with any measure the judge considers necessary to keep the order confidential (s. 20.4(5)), and ask a business to produce records voluntarily, with no criminal or civil proceedings lying against it for doing so (ss. 20.6–20.7). Financial institutions are separately barred by anti-money-laundering “tipping-off” rules from telling a customer that a suspicious transaction report has been made: in Canada under section 8 of the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, in the United Kingdom under section 333A of the Proceeds of Crime Act 2002, and in the United States under 31 U.S.C. § 5318(g)(2).

An institution enforcing its own terms can say which term was broken and how. Wise cited its terms three times without ever saying how they were broken, then said the law restricts it from disclosing what it relied on, without naming the law. That is the answer of an institution bound by a confidentiality obligation, the kind that attaches to a government request or a regulatory report. Those laws do not say who asked or why. Revolut similarly invoked legal requirements without detail: it was “required by law” to run the review, and it froze incoming funds under “standard requirements” it follows “as a regulated provider.” Equibit Group’s position is that the same pattern from separate institutions, over accounts that had barely been used, fits an operation run through financial intermediaries under the cover of exactly those obligations.

This is Equibit Group’s position. Wise has not identified the terms it says were broken, Revolut has not explained its review, and no court has determined why the accounts were closed.

5. The TD Email: A Statement Taken Under Threat

The record. In early 2026 a long-time TD Canada Trust customer, whom Chris Horlacher had recently met at Anarchapulco 2026, tried to wire a membership fee to one of Horlacher’s clients. TD blocked the transfer. In an email to Horlacher, quoted in De-Banking and Institutional Pressure, the customer wrote that three days later “we were contacted by a mystery figure in the TD organization who only identified himself by his first name… He proceeded to drill us on what the wire transfer was for… After a lengthy question period and listening to his repeated accusations that we were taking part in a scam he suddenly said he was closing all my accounts at TD.” The customer had banked with TD for 65 years. According to his account, the accounts were restored only after he and his wife agreed the payment might be a “scam” and promised not to deal with the Horlacher-linked business again.

Why it fits. Blocking a payment and threatening to close every account unless the customer disowned it is interrupting a financial transaction, paragraph (e) of section 21.1(1.1). Equibit Group’s position is that the statement was false and was extracted by the threat of closing the customer’s accounts, and that a TD representative who would give only a first name, acting against a payment to a Horlacher-linked business, fits a covert measure carried out through a bank. TD has never contacted Chris Horlacher for comment or an explanation, although he holds a personal account at TD and the bank could have reached him at any time.

This account comes from the customer’s email and is Equibit Group’s position. No court has determined what happened.

6. The Strange Calls, and the One That Traced Back to CIBC

The pattern. Chris Horlacher has received multiple calls from people who expressed interest in a client’s services but refused to give their full names or their employer (De-Banking and Institutional Pressure). Some of those callers tried to draw him into regulated money-transmission work without a licence.

The CIBC call. One call came from the CIBC toll-free number 1-866-639-5014. It was the first of these calls to trace back to a known source. The caller did not ask Horlacher to carry out any transaction. The caller refused to say who they were or whom they worked for, while demanding that he provide whatever information they wanted. The CIBC employee on the line was plainly lying to him and concealing their identity. Horlacher recorded most of the call.

What a bank caller owes the person on the other end. A bank employee who calls someone has to say who they are, whom they represent and what the call is about. CIBC’s own Code of Conduct, which binds every employee, commits the bank to comply with the law and states that, when dealing with a client, employees never engage in “using misleading language” or “taking advantage of, imposing pressure on, or coercing an existing or potential client for any purpose” (ss. 2.1 and 2.5). CIBC tells the public that “CIBC or a government agency will never contact you to ask for your personal or banking information. That information is already on file.” The Bank Act, the core of the federal Financial Consumer Protection Framework, forbids a bank, in its dealings with customers and the public, to “impose undue pressure on a person” or “take advantage of a person” (s. 627.04). The Financial Consumer Agency of Canada tells anyone who receives an unsolicited call asking for personal or financial information to “ask for the caller’s name, company name and department.” Even telemarketers must, on reaching the person they called, give the caller’s name (a fictitious name is allowed) and the name of the company calling, under section 16 of Part III of the CRTC’s Unsolicited Telecommunications Rules. Those rules govern sales calls, and a bank calling to extract information should meet at least the same standard. PIPEDA, which governs how a bank collects personal information, requires the purposes of collection to be identified “at or before the time the information is collected,” and requires information to be “collected by fair and lawful means,” a requirement “intended to prevent organizations from collecting information by misleading or deceiving individuals about the purpose for which information is being collected” (Schedule 1, Principles 4.2 and 4.4, clause 4.4.2). Equibit Group’s position is that a CIBC employee who called from CIBC’s line, refused to say who they were or whom they represented, and pressed for information acted against CIBC’s own Code and against the standards that the Bank Act and PIPEDA set for how a bank deals with the public and collects personal information.

Why it fits. Collecting information “by investigation or otherwise” is CSIS’s core function under section 12 of the CSIS Act. A caller on a bank’s line who conceals their identity and employer while pressing the target for information is covert collection by pretext. The CSIS Act exempts CSIS employees, and anyone acting under their direction, from liability for false statements made to establish or maintain a covert identity (s. 18.2). That is the cover a bank employee would need to break the rules above. Where impersonation serves a threat-reduction measure, it is paragraph (g) of section 21.1(1.1). The other callers’ attempts to draw Horlacher into unlicensed money transmission fit paragraph (d): “making or attempting to make, directly or indirectly, any financial transaction that involves or purports to involve currency or a monetary instrument.” Equibit Group’s position is that these calls were one pattern of covert inducement and information-gathering, and that the CIBC call is the one that showed which line it ran through.

This is Equibit Group’s position, based on the recording and Chris Horlacher’s account of the other calls. CIBC has not explained the call, and no court has determined who made these calls or why.

7. The 2018 Approach to Equibit’s Developers

The record. Justice Merritt’s endorsement of May 12, 2023 records Sergei Sachkov’s own account: “In 2018 someone approached Sachkov, said they were from the Canadian government and said they were investigating Equibit.” The endorsement also records that Horlacher told him at the time the approach was a scam; Equibit then had no way to know who had made it. The Statement of Claim pleads that Sachkov had at least two interviews with the CSIS Defendants (para. 17), that wallet developer Kartik Patel resigned after four weeks on July 20, 2018, saying he could not stay because Equibit were “good guys” (para. 23), and that both were induced or coerced to disclose Equibit’s confidential information (para. 24). The Crown’s s. 38 application now names both men as parties “whose interests are affected” by the protected information.

Why it fits. Approaching a target company’s developers and eliciting its confidential information is classic human-source work, the activity the OIC’s s. 16(1)(c) exemption protects when it refers to covert employees, and the activity section 18 of the CSIS Act shields. If CSIS had no involvement in the facts of this case, nothing in its production would affect the interests of the two developers the claim says it approached. Equibit Group’s position is that the protected information relates to these contacts.

These are allegations in the Statement of Claim. None of them has been determined by a court.

8. The Network Probes While the Crown Was in Default

The record. In December 2020, with the Attorney General’s defence overdue, Chris Horlacher deployed a honeypot named “Equibit-Dev” on his home network, a Rogers connection in Canada. As documented in Honeypot Probes: Government-Linked Network Activity, it was probed almost at once from the link-local address 169.254.15.240, which returned over the following weeks and eventually identified itself on his network as “Equibit-Dev.local,” copying the honeypot’s own name. The external address 168.254.7.38, on an autonomous system registered to Charter Communications (AS33363), then probed the honeypot once on January 3, 2021 and three more times on May 30, 2021.

Sixteen days after the January 3 probe, on January 19, 2021, the Attorney General advised Equibit that “CSIS has no knowledge of the acts alleged” (Statement of Defence, para. 8). The May 30 probes came four months before the Statement of Defence pleaded that CSIS “did not engage in the acts alleged.”

Why it fits. A section 21 warrant can authorize CSIS to “intercept any communication” and “to install, maintain or remove any thing.” A probe from inside the local network segment is consistent with access at the router or ISP level. The Federal Court found in 2016 FC 1105 that CSIS had unlawfully retained metadata collected under warrants. Equibit Group’s position is that the probes are consistent with warrant-based interception running while the Crown was telling Equibit it knew nothing.

This is Equibit Group’s position on the technical record. Attribution has not been determined by a court.

The Powers Fit. The Target Doesn’t.

Set the eight operations beside the CSIS Act and every one of them matches a power Parliament gave CSIS:

• The hacking: disrupting and degrading communications, and interfering with records and equipment (s. 21.1(1.1)(a) and (b)).
• The hostile takeover attempt: purported resolutions and notices of meeting, documents of the kind paragraph (c) covers.
• The fake websites and toxic backlinks: fabricating and disseminating information, and impersonating a person (paras. (c) and (g)).
• The debankings: interrupting financial transactions (para. (e)).
• The TD email: covert collection “by investigation or otherwise” (s. 12), and the closure of the accounts (para. (e)).
• The strange calls: covert collection by pretext (s. 12), attempts to draw Horlacher into financial transactions (para. (d)), and impersonation (para. (g)).
• The 2018 approach to Equibit’s developers: human-source collection (s. 12), with identities shielded by section 18.
• The network probes: collection (s. 12) and interference with a means of communication (para. (a)).

The one event in Equibit’s record that fits none of this is the November 2018 attack on Chris Horlacher’s wife, Meera, at World Crypto Con in Las Vegas (The Assassination of Equibit). It happened in the United States, and no Canadian took part in it.

The powers fit. What falls apart is the threat. Every one of those powers rests on it. CSIS collects information about “activities that may on reasonable grounds be suspected of constituting threats to the security of Canada” (s. 12(1)). It may take threat-reduction measures only “If there are reasonable grounds to believe that a particular activity constitutes a threat to the security of Canada” (s. 12.1(1)). Section 2 defines that phrase narrowly: espionage or sabotage; foreign-influenced activities that are “clandestine or deceptive or involve a threat to any person”; serious violence “for the purpose of achieving a political, religious or ideological objective”; and the covert undermining or violent overthrow of “the constitutionally established system of government in Canada.” Then it shuts the door. The definition “does not include lawful advocacy, protest or dissent, unless carried on in conjunction with any of the activities referred to in paragraphs (a) to (d)” (s. 2).

Chris Horlacher and Equibit Group advocated Austrian economics, sound money, decentralized finance and limited government, and built technology for issuing and transferring securities on a blockchain. None of that is espionage, sabotage, foreign influence, violence or subversion. It is lawful advocacy and dissent, protected by the Charter’s guarantees of “freedom of thought, belief, opinion and expression” and “freedom of association” (Charter, s. 2(b) and (d)), and every threat-reduction measure must comply with the Charter (s. 12.1(3.1)). It is exactly how citizens of a democratic society are supposed to conduct themselves. Yet CSIS’s own SECRET assessment of February 12, 2018 filed cryptocurrency under “Alternative Means of Funding: The Extreme Right and Cryptocurrency.” Equibit Group’s position is that treating advocates of sound money and limited government as a threat to the security of Canada punishes wrong-think, and that no lawful threat finding could support the operations set out above.

Those threat assessments do not stay in a file. To get a warrant, CSIS applies to a Federal Court judge with an affidavit deposing to “the facts relied on to justify the belief, on reasonable grounds, that a warrant under this section is required to enable the Service to investigate a threat to the security of Canada” (s. 21(1) and (2)(a)). Threat-reduction measures that would limit a Charter right or break Canadian law need a warrant under section 21.1. Every one of those applications “shall be made ex parte and heard in private” (s. 27(1)). The judge hears only CSIS, and the only account of the target is the one CSIS wrote.

Equibit Group’s position is that the same threat assessment has almost certainly been put before the Federal Court to obtain warrants, recasting a chartered accountant and sound-money advocate as a sophisticated financial or economic threat. A fabricated profile is only as strong as the judge’s ability to test it, and in an ex parte hearing no one tests it. CSIS’s record in exactly that setting is poor. Justice Mosley found that CSIS breached its duty of candour in warrant applications by not disclosing that it would enlist foreign partners (2013 FC 1275; CBC). Justice Noël found it breached the same duty by not disclosing its retention of metadata (2016 FC 1105; CBC). In 2020 the Federal Court found it had relied in warrant applications on information that was likely collected unlawfully, without telling the court (2020 FC 616; CBC).

That profile would be easy to sell. Equibit Group’s position is that hostility to cryptocurrency runs through the Canadian legal community, and Equibit’s own file shows it. Setting aside the default judgment against Sergei Sachkov, Justice Merritt’s endorsement of May 12, 2023 found it “reasonable for him to be concerned about fraud because there are many unsavory characters in the cryptocurrency space” (p. 2), and wrote that “Equibit admits [t]here are many dangerous characters in the cryptocurrency industry and fraud is rampant” (p. 3). Equibit admitted no such thing. When Sachkov’s counsel put that framing to Chris Horlacher in cross-examination, his answer was a direct “No.” In discovery he said the opposite: fraud is no more or less prevalent in the crypto industry than in any other. Neither Sachkov nor the endorsement cited a single case of fraudulent legal papers being served on anyone, by a crypto company or by any other. A generalization about an entire industry, unsupported by evidence and attributed to a plaintiff who rejected it under oath, became the reason a properly served defendant could ignore the claim. Horlacher’s review of the endorsement, written as a chartered accountant, calls those claims “patently false and prejudiced” (Auditing Justice Merritt’s Decision). The statement is the first of five problems in Equibit’s complaint to the Canadian Judicial Council, file 26-0478 (Complaint Filed with the Canadian Judicial Council), which also lists the endorsement’s amplification of Justice Myers’s causation doubts as part of the same one-sided framing. Equibit Group’s position is that a warrant application casting a cryptocurrency founder as a financial threat lands on exactly that bias. That is why the warrant applications and their supporting affidavits are part of what the court must see, and why, if they stay secret, an amicus must test them.

After destroying the business for wrong-think, the conduct pivoted to obstructing justice. The takeover attempt sought control of Equibit’s counsel during the July and August 2025 discovery window. The Crown denied any CSIS knowledge or involvement and listed no documents, then brought a section 38 application to keep CSIS’s production secret. Section 12.2(1)(b) forbids CSIS, in taking any threat-reduction measure, to “wilfully attempt in any manner to obstruct, pervert or defeat the course of justice” (s. 12.2(1)(b)). That limit does not depend on the target. A genuine threat would not license it. That is why production matters: the threat assessments and the section 12.1(3.5) notifications to the Review Agency will show what threat CSIS identified, and whether any measure reached into this litigation.

This is Equibit Group’s position. Whether CSIS identified Equibit or Chris Horlacher as a threat to the security of Canada, and on what grounds, has not been determined by a court.

The Crown’s Likely Answer

The March 3, 2026 release identified a SECRET CSIS assessment dated February 12, 2018, titled “Alternative Means of Funding: The Extreme Right and Cryptocurrency,” with its final page fully redacted. It does not mention Equibit. The Crown may say that any CSIS interest in Equibit was incidental to a sector-wide cryptocurrency file, perhaps one built on foreign-partner information of the kind the OIC’s s. 13(1) finding describes. CSIS has drawn foreign partners into collection before without telling the court: in 2013 FC 1275 (paras. 117–118) Justice Mosley found it had kept the court in the dark about its use of Five Eyes partners, a finding the Federal Court of Appeal upheld (CBC; CBC). Equibit Group’s position is that a sector-wide file that touched Equibit is still knowledge. It is a relevant document, and the Defence denied any knowledge at all.

Why the Court Needs to Order Production

Two courts have a role, and each has the tools to get to the truth.

The Ontario Superior Court: a complete affidavit of documents

Under rule 30.02(1) of the Rules of Civil Procedure, every document relevant to any matter in issue that is or has been in a party’s possession, control or power must be disclosed, “whether or not privilege is claimed in respect of the document.” Privileged documents are still listed, with the grounds for privilege stated. Under rule 30.06, where the court is satisfied by any evidence that a relevant document has been omitted or that privilege has been improperly claimed, it may order cross-examination on the affidavit of documents, service of a further and better affidavit, and production of the documents.

The Crown’s own s. 38 notice is that evidence. A List of Documents “listing no documents” cannot be squared with documents “required to be disclosed in the Underlying Proceeding” that contain national security information. Section 38.02 bars disclosure of the protected information itself until the Federal Court rules, but it does not excuse a party from swearing a complete and honest affidavit of documents or from producing everything that is not covered by the notice. Equibit Group’s position is that the Superior Court should order a further and better affidavit of documents from the Attorney General, with every relevant CSIS record identified and every privilege claim stated, and production of all unprotected material.

The Federal Court: section 38 is a balancing test, not a veto

Under section 38.06 of the Canada Evidence Act, the Federal Court can authorize disclosure where the public interest in disclosure outweighs the public interest in non-disclosure, and it can order disclosure of part of the information, a summary, or a written admission of facts, on conditions. The test comes from Canada (Attorney General) v. Ribic, 2003 FCA 246:

• Relevance. The threshold is low (Ribic, para. 17). In civil proceedings the Federal Court has recognized that a party who has not seen the information cannot be expected to prove precisely how it helps, and that relevance must be assessed with that in mind (Sharafaldin v. Canada (Attorney General), 2021 FC 22, paras. 29–31). CSIS’s knowledge of and involvement with Equibit is the central issue in the action. Information in CSIS’s own production on that subject is relevant on any standard.
• Injury. The Attorney General must prove, with evidence, a factual basis for the claimed injury; injury must be probable, not merely possible (Ribic, paras. 18–19; Sharafaldin, para. 33). In a related setting, the Federal Court has warned against accepting “generalized assertions of possible disadvantage to an ongoing investigation” (Wang v. Canada, 2016 FC 493, para. 35). CSIS’s OIC submissions are exactly that kind of assertion.
• Balancing. The Federal Court weighs, among other factors, whether the information will probably establish a fact crucial to the case, the seriousness of the issues, whether there are other reasonable ways to obtain the facts, and whether the request is a fishing expedition (Wang, para. 37). Each favours Equibit: the fact in issue is whether CSIS was involved at all; the allegation is that state agents induced employees to hand over a Canadian company’s proprietary information while the Crown denied any knowledge; CSIS is the only holder of its own records, and the access-to-information route has been exhausted; and the documents are not a fishing target, because the Crown itself identified them in its s. 38 notice.

There is a fairness point as well. Once the Crown chooses to speak on an issue, it cannot disclose only the part that helps it (Wang, para. 72). The Crown put CSIS’s non-involvement in issue in its Defence and in its 2025 letter. Having denied any involvement, it should not be allowed to rely on secrecy to keep the court from testing that denial.

An Ex Parte Hearing Needs an Amicus

The Attorney General says “an ex parte in camera hearing is necessary.” That means the court will hear CSIS’s side alone. The Federal Court has repeatedly found that CSIS did not meet its duty of candour in exactly that setting: 2013 FC 1275 (foreign partners), 2016 FC 1105 (unlawful metadata retention; CBC), and 2020 FC 616 (reliance on likely unlawfully collected information; CBC). The National Security and Intelligence Review Agency’s 2022 review found the problems were systemic (CBC). In Wang, the court appointed an amicus curiae to test the government’s secrecy claims (para. 41). Equibit Group’s position is that, on this record, the Federal Court should appoint an amicus with full access to the protected information, and should order disclosure, or at minimum a meaningful summary, of every document that bears on CSIS’s knowledge of and dealings with Equibit and its developers.

Place in the Equibit Lawsuit

This analysis sits between the OIC record and the s. 38 application. The OIC report shows CSIS describing foreign partners, tradecraft and covert employees behind its cryptocurrency records, and intelligence operations it says are ongoing. The s. 38 application shows the Crown protecting information in the production of a lawsuit in which it pleaded that CSIS had no involvement. Equibit has documented eight sets of events that fit the measures the CSIS Act allows. Equibit Group’s position is that a production order in both courts is the only way the truth about those operations reaches the trial judge.

Further Reading

• AG Seeks Section 38 Secrecy Order in the Equibit Lawsuit
• Five Things the OIC Final Report Established That Contradict CSIS’s Position
• Seven Documented Technical Attacks Against Equibit and Chris Horlacher
• Statement of Claim Filed Against Marc Godard
• Six Key Facts About the Impersonation Websites
• De-Banking and Institutional Pressure
• De-Banked Again: Wise Joins Revolut
• The Statement of Claim Against CSIS
• The Attorney General’s Statement of Defence
• CSIS, Secret Federal Court Warrants and Breaches of Candour
• Eight Red Flags
• Complaint Filed with the Canadian Judicial Council Against Justice Loretta P. Merritt
• Auditing Justice Merritt’s Decision
• An Ultimatum to the Attorney General of Canada