CSIS takes care of it, and to give a generic definition, they look into possible "threats to Canada". Can be anything like risk of terrorism, spying, money laundering, or really any criminal activity done abroad...
Obviously, this is frustrating for the "average applicant" whose worst offense is...