Thursday, December 19, 2024

2023-24 was CSE's first billion-dollar year

The Public Accounts of Canada 2024, tabled in parliament on December 17th, confirm that fiscal year 2023-24 was CSE's first billion-dollar year. The agency spent $1,010,795,977 during the fiscal year that ended on March 31st, 2024.

CSE has been growing almost continuously since 2001. Its 2001-02 budget was originally projected to be $100 million, or about $173 million in today's dollars — just over one-sixth of its 2023-24 spending. That's probably about what the agency would have ended up spending that year had it not been for the 9/11 attacks, which completely changed the budget picture. The actual amount CSE spent that fiscal year was $189 million, or about $327 million in 2024 dollars.

But while the "Global War on Terror" was responsible for the initial boosts in CSE's spending in the years that followed, what really kept the money taps flowing was the explosive growth of the Internet and ubiquitous computing, which created a vast new source of intelligence ripe for the gathering, new forms of vulnerability that required a greatly expanded cybersecurity response, and, more recently, a global arena for cyber-enabled operations.

It's that transformation that has kept CSE growing for more than two decades and that keeps it growing still. 

The Supplementary Estimates (B), 2024-25, tabled in November, boosted CSE's fiscal year 2024-25 budget authority to $1,126,635,267. 

We'll have to wait for next year's Public Accounts to see what the actual amount that is spent this year turns out to be, but even further growth is in the plan. In October, CSE Chief Caroline Xavier stated that the agency expects to have more than 4,000 — almost 5,000 — employees by the time its currently approved growth is done. As of 31 March 2024, the agency had 3,529 employees. 

 

Spending by program

Little information is released about the details of CSE's spending, but the GC Infobase does provide a breakdown of that spending into broad programs that is updated every year after the Public Accounts come out. 

Originally, two major programs were listed: Foreign Signals Intelligence and Cyber Security. But for the past two years, CSE's spending has been broken into four programs (click image for a better view). In 2023-24 it was: $356,782,293.49 for Foreign Signals Intelligence, $11,932,939.62 for Foreign Cyber Operations, $291,671,819.01 for Operations Enablement, and $350,408,924.73 for Cyber Security.

(See here for further discussion of these categories.)

Of particular interest is the information on CSE's Foreign Cyber Operations (FCO) program, under which the agency executes its active cyber operations and defensive cyber operations mandates. This is one of the few windows we have into the scale of that program. 

In 2022-23, the first year for which these data were provided, $9,145,757.10 was spent on the FCO program. The $11,932,939.20 total recorded for 2023-24 is 30% higher than 2022-23's total. It still accounts for just 1.2% of CSE's overall budget, however.

In personnel terms, that might translate into as many as 90 full-time equivalent (FTE) employees in the FCO program, although it could be as few as 40 if administrative, accommodation, and other support costs are included in the spending total. These are very small numbers in comparison to CSE's overall staff, but — guessing wildly here — CSE may not need more than a few hundred operators in the FCO program, at least in the near future. Even at its current size, the cyber operations program may be approaching the scale where CSE can contemplate sustained, simultaneous operations against at least a couple of objectives, particularly if conducted in cooperation with other partners.

On that question, CSE has acknowledged that it takes part in, and even sometimes leads, combined cyber operations with international partners, and it also has domestic partners, most notably the Canadian Armed Forces' Cyber Command (CAFCYBERCOM).

CAFCYBERCOM's capabilities are themselves still nascent, but for a decade now CSE and the armed forces have been slowly building the capacity to conduct combined cyber operations through their Combined Cyber Unit (CCU), a joint CSE-CAF entity that can operate under CSE authorities, CAF authorities, or a blend of the two.

It will be interesting to see how CSE's (and the CAF's) cyber operations capabilities evolve as time goes on.


Tuesday, October 08, 2024

The spies who came south from the cold: CSE's 1980s renaissance

The following is the presentation I made on day one of the Canadian Intelligence History at the Crossroads conference, held in Ottawa on 3-4 October 2024.

(Image credit: Charles Stankievech)

The birth of the Canadian Security Intelligence Service dominated the headlines in the mid-1980s, but Canada’s signals intelligence agency, the Communications Security Establishment, underwent a quiet rebirth of its own during the same years, shifting from an almost exclusive focus on the Soviet north and adding an array of new collection and processing capabilities to increase the agency’s value both to the Canadian government and its intelligence partners.

 


From its beginning, CSE worked in close integration with the UKUSA intelligence partnership, now commonly called the Five Eyes, in particular with its much larger U.S. and U.K. members. By 1957, the Canadian SIGINT program was focused almost entirely on Soviet long-range, high-frequency radio communications in the Arctic and the northern Soviet Union. This material provided the main Canadian contribution to the allied foreign intelligence partnership, in return for which we got access to a very wide range of U.S. and U.K. intelligence reporting.

You can read more about the development of CSE’s Arctic role in Wesley Wark’s 2020 article “Favourable geography:Canada’s Arctic signals intelligence mission” in the journal Intelligence and National Security.

On this map you can see the radio intercept stations that were operated for CSE by the Canadian Forces Supplementary Radio System during the 1970s and into the 1980s: Leitrim here in Ottawa, Gander in Newfoundland, Masset in Haida Gwaii, B.C., plus two stations in the Far North, Inuvik and Alert, with Alert being the most important of the collection sites.

The Supplementary Radio System also operated a radio direction-finding site in Bermuda, used mostly to monitor the movements of Soviet missile subs and other maritime operations, which David Charters will be talking about later today.


This division of effort worked well for CSE, but as time went on HF radio declined in importance in Soviet communications, leading to allied dissatisfaction with the scale of Canada’s already small contribution. There was also concern within the Canadian government about a lack of political and economic intelligence on topics of special interest to Canada that were not well covered by allied reporting.

Some efforts were made to diversify CSE’s collection and processing in the 1970s, but only minor progress was made, due to a number of factors, including very tight budget constraints and lack of strong Cabinet-level engagement.

[Parenthetic comment I didn't have time for in the conference presentation: Not all diversification efforts were unsuccessful. The image shows a Soviet troposcatter communications site. Although more isolated locations and mobile emitters such as ships and aircraft continued using HF radio, troposcatter systems replaced a lot of Soviet communications in the far north. This posed a problem for CSE as these systems couldn't be monitored by Canadian intercept stations. But they could be monitored by the geosynchronous SIGINT satellites that the U.S. began launching in the late 1960s, and in 1971 CSE was brought in to help process the take from those satellites.] 


Things started to improve for CSE in the early 1980s with the start of the PILGRIM program, which picked up from an earlier experimental intercept site in Canada’s Moscow embassy that had operated for a couple of years starting in 1972.

However, the big change came in 1984, when CSE cut a deal with the Department of National Defence and Treasury Board to close the intercept site at Canadian Forces Station Inuvik but continue funding the station’s 276 person-years for use elsewhere in the SIGINT program, mostly at CSE itself. DND, which was receiving large annual budget increases of its own by this time, also agreed to provide a small injection of new capital funding for CSE and the SRS.

This enabled CSE to propose a wide-ranging set of improvements to its collection and processing programs, which it put forward in its Strategic Overview for the Cryptologic Program, 1985-1988, presented to the Interdepartmental Committee on Security and Intelligence in March 1984.

(Huge thanks, by the way, to the Canadian Foreign Intelligence History Project for obtaining the release of this document and many of the others relied upon for this presentation.)

The plan was designed to help CSE address three main challenges: to broaden its collection focus to provide the government with more domestically produced economic and political intelligence while continuing to provide defence-related intelligence; to improve CSE’s contribution to the UKUSA intelligence pool and thus preserve our access to the vast output of our UKUSA partners; and to modernize CSE’s collection and processing capabilities, maintain compatibility with partner systems, and keep up with changing communications technologies used by SIGINT targets.

Presented with an improvement program requiring no new budget allocations, the committee had few objections. Each of the separate elements of the plan was considered individually by the committee, however, with the proposal to purchase a supercomputer approved immediately, other elements approved during the summer, and still other, longer-term, parts dealt with over the next several years, with some of the latter delay caused by the need to complete policy reviews initiated by the new Mulroney government after the September 1984 election.


The first element of plan that ICSI approved was Project ELEVATOR, the purchase of a Cray X-MP supercomputer and hiring of the staff needed to revitalize CSE’s cryptanalysis, or codebreaking, program.

This is a photo of that computer, which was the most powerful computer in Canada at the time of its purchase. Today the smartphone in your pocket would leave it in the dust, but when it was received in 1985 it revolutionized Canada’s cryptanalytic capabilities.


Canadian participation in ECHELON, the UKUSA program to monitor traffic on commercial satellites, was given initial approval in June 1984. Legal concerns, possibly related to the potential for inadvertent collection of Canadian private communications, delayed the start of monitoring operations, but by 1988 those concerns had been resolved.

This photo shows Leitrim in 1991. You can see the radomes covering the ECHELON satellite dishes at the top of the image.

A redacted part of CSE’s Strategic Overview seems to indicate that a different site was originally proposed for this program. I think that site may have been in Alberta, but that’s just a guess, and it may well be wrong. I submitted an Access to Information request on this question just over a year ago, but any of you familiar with that process can guess how that’s going. Still waiting.

 

PILGRIM was the program to operate intercept sites in Canadian diplomatic facilities. Approval to conduct surveys of potential sites seems to have been granted around October 1981. According to former CSE employee Mike Frost, the first permanent site began operations in New Delhi in 1983. (That’s the High Commission shown here).

All discussion of PILGRIM was redacted from the released version of CSE’s Strategic Overview document, but there is little doubt that additional sites figured as part of CSE’s plan, and other documents confirm that expansion of the program got the go-ahead no later than 1987.


MADRIGAL was the covername for foreign intelligence collection in Canada under s.16 of the CSIS Act. This of course depended on the passage and then entry into force of that Act, which happened at the end of August 1984.

This was a program that CSE had long pushed for. A tri-ministerial memorandum of understanding on how to initiate such operations was completed in 1987, but according to CSIS’ original watchdog, the SIRC, actual operations took a while to get off the ground, with little activity before the 1990s.


None of the foregoing meant that Canada was abandoning HF radio collection in the north, and the Strategic Overview plan also contained a program, PORCUPINE II, to modernize and streamline conventional radio collection at the intercept sites and ensure its compatibility with UKUSA partner systems.

Approved in August 1985, the program was expected to improve collection and compensate for the closure of Inuvik while generating an additional savings of 22 person-years.


Largely as a result of the Inuvik bargain, CSE was able to grow from around 600 employees at the beginning of the 1980s to around 900 by the end of the decade.

This included an increase in the SIGINT part of the organization from around 460 to around 700, enabling the agency to hire more analysts to cover its broader range of targets, begin limited 24/7 operations (mostly, I think, related to real-time processing of Soviet air activities facilitated by PORCUPINE II [and also by the High Arctic Data Communications System]), and staff the Client Relations Officer program that was used to relay SIGINT directly to senior departmental consumers.

Here's an ad CSE placed in the Ottawa Citizen in 1986 looking for Transcriber Analysts with “Slavic, Oriental, Middle Eastern or Romance language” abilities, reflecting the agency’s growing range of targets.

Some of the Inuvik person-year savings were retained by the military and used to create 771 Communications Research Squadron, which stood up in October 1987. Rather than serving at a intercept site, this unit was assigned to the Sir Leonard Tilley Building, CSE’s headquarters at the time, and its members were integrated into CSE’s SIGINT sections, boosting the total number of SIGINT personnel working within the agency to around 800 by the end of the decade – an increase of nearly 75% over the beginning of the 1980s.


To accommodate all these people, C Wing, the windowless concrete structure on the right, was added to the Tilley Building. Construction began in 1989 and was completed in 1992. I took this photo in 1990.

As most of you probably know, CSE left the Tilley Building in 2014-15, and — perhaps less well known — the newly renovated C Wing is soon to be the new home of the Government Operations Centre.


All of this was completed just around the time the Cold War ended, taking with it many of CSE's old Soviet targets.

Much of interest continued going on in the former Soviet space, of course, but CSE might well have shrunk significantly had it not already built the capability to monitor a much wider array of targets around the world.

Instead, the agency’s budget and staffing remained fairly static over the 1990s, declining only slightly, even as virtually every other department and agency in Ottawa suffered sharp reductions.

 

Since the 1990s, and particularly since 9/11, CSE has been growing almost continuously. It is now four times the size it was at the end of the 1980s. Four times!

The agency’s operations are increasingly cyber-focused, but not everything has changed. The satellite dishes are still in place. The embassy sites remain. S.16 operations continue. And even the radio intercept sites are still in operation, although remotely operated from Leitrim.

The red line on this satellite photo shows a 1-km-long Beverage antenna at the Masset intercept station. DND recently built a boardwalk to facilitate maintenance of this antenna, showing that it is still in active service.

An antenna like this is very highly directional, so it is not too hard to figure out what it’s listening to. The long-range radio transmissions it collects emanate from northern Russia.

I mention all this to bring things full circle. CSE did come “south from the cold” in the 1980s, and the changes since then have been even greater. But even with all the change that has happened, the Arctic mission was never abandoned, and it still goes on today.