Is CSE metadata-mining Canadian call records?

The recent confirmation that NSA is performing data mining on the telephone records of Americans raises an important question for Canadians, is CSE likewise mining the call records of people in Canada?

The short answer is I don't know. But there are some telling indications that CSE is interested in undertaking such monitoring and that it may well be doing it to one degree or another.

First, let's look at the program in the U.S. From the original Guardian report and subsequent revelations (see, for example, Shane Harris, "What We Know About the NSA Metadata Program," Dead Drop blog, 6 June 2013) we now know quite a lot about the NSA's domestic phone records monitoring program, including the following features about it:

• Current procedures date from 2006, but the program began in 2001
  
• Entails data mining of nationwide telephone call records
  
• Focus on metadata, not content
  
• Network analysis involved
  
• Undertaken as part of counter-terrorism effort

Now consider this description of data mining research conducted in 2006 by CSE and the Mathematics of Information Technology and Complex Systems (MITACS) project, a Canadian network of academia, industry, and the public sector (originally posted here but subsequently removed; archived version here; first blogged by me here):

As part of ongoing collaborations with the Communications Security Establishment (CSE), we are applying unsupervised and semi-supervised learning methods to understand transactions on large dynamic networks, such as telephone and email networks. When viewed as a graph, the nodes correspond to individuals that send or receive messages, and edges correspond to the messages themselves. The graphs we address can be observed in real-time, include from hundreds to hundreds of thousands of nodes, and feature thousands to millions of transactions. There are two goals associated with this project: firstly, there is the semi-supervised learning task, and rare-target problem, in which we wish to identify certain types of nodes; secondly, there is the unsupervised learning task of detecting anomalous messages. For reasons of efficiency, we have restricted our attention to meta-data of message transactions, such as the time, sender, and recipient, and ignored the contents of messages themselves. In collaboration with CSE, we are studying the problem of counter-terrorism, a semi-supervised problem in which some terrorists in a large network are labeled, but most are not.... Another common feature of counter-terrorism problems is the fact that large volumes of data are often "streamed" through various collection sites, in order to provide maximal information in a timely fashion. A consequence of efficient collection of transactions on very large graphs is that the data itself can only be stored for a short time. This leads to a nonstandard learning problem, since most learning algorithms assume that the full dataset can be accessed for training purposes. Working in conjunction with CSE, we will devise on-line learning algorithms that scale efficiently with increasing volume, and need only use each example once. [Emphasis added.]

Note these features:

• Applicable to telephone and email networks
  
• Thousands to millions of transactions
  
• Metadata, not content, examined
  
• Counter-terrorism related

Familiar looking?

Consider also this comment made by then-CSE Chief John Adams to the Standing Senate Committee on National Security and Defence on 30 April 2007:

What is your interpretation of intercept, if I were to ask? If you asked me, it would be if I heard someone talking to someone else or if I read someone's writing. An intercept would not be to look on the outside of the envelope. That is not an intercept to me. Unfortunately, that is not everyone's interpretation of intercept, so the suggestion is that we should define that in the legislation.... Intercept is defined in another piece of legislation, and that is where people would probably look if they were searching for a definition of intercept. They are saying that could be troublesome for us, so we had better define it in our act to avoid that problem. That sort of thing has not come up as an issue, but it could.

As I noted in an earlier post, that sounds an awful lot like something you would say if you wanted to collect phone call metadata (number called, duration of call, etc.) and similar addressing information for e-mails and other communications -- and felt you already had the legal basis to do so.

Would such monitoring be legal in Canada? I don't know. (Usual disclaimer about not being a lawyer applies.)

Michael Geist suggests that s. 21 of the CSIS Act might be used to authorize the activity; CSE's participation would then be based on CSIS's authority.

Another possibility is that CSE might consider its foreign intelligence mandate (processing the records as part of the hunt for foreign terrorists) sufficient to authorize such monitoring. It is possible that this somewhat cryptic passage in the CSE oversight commissioner's 2010-11 Annual Report is referring in whole or in part to such activities:

CSEC conducts a number of activities for the purposes of locating new sources of foreign intelligence. When other means have been exhausted, CSEC may use information about Canadians when it has reasonable grounds to believe that using this information may assist in identifying and obtaining foreign intelligence. CSEC conducts these activities infrequently, but they can be a valuable tool in meeting Government of Canada intelligence priorities. CSEC does not require a ministerial authorization to conduct these activities because they do not involve interception of private communications. However, a ministerial directive provides guidance on the conduct of these activities.

In recent years, three reviews have involved some degree of examination of these activities: a Review of CSEC's foreign intelligence collection in support of the Royal Canadian Mounted Police (RCMP) (Phase II) (2006); a Review of CSEC's activities carried out under a (different) ministerial directive (2008); and a Review of CSEC's support to the Canadian Security Intelligence Service (CSIS) (2008).

In his 2006–2007 Annual Report, the late Commissioner Gonthier questioned whether the foreign signals intelligence part of CSEC's mandate (part (a) of its mandate) was the appropriate authority in all instances for CSEC to provide support to the RCMP in the pursuit of its domestic criminal investigations. In his 2007–2008 Annual Report, Commissioner Gonthier stated that pending a re-examination of the legal issues raised, no assessment would be made of the lawfulness of CSEC's activities in support of the RCMP under the foreign signals intelligence part of CSEC's mandate. He also noted that CSEC's support to CSIS raised similar issues. Commissioner Gonthier emphasized that although he was in agreement with the advice that the Department of Justice had provided to CSEC, he questioned which part of CSEC's mandate — part (a) or part (c), the assistance part of CSEC's mandate — should be used as the proper authority for conducting the activities.

Subsequent to these reviews and statements in the annual reports, the Chief of CSEC suspended these activities. CSEC then made significant changes to related policies, procedures and practices.

Review rationale

These activities involve CSEC's use and analysis of information about Canadians for foreign intelligence purposes. Specific controls are placed on these activities to ensure compliance with legal, ministerial and policy requirements. Major changes to certain policies, procedures and practices have recently occurred. This was the first review of these activities since the Chief of CSEC allowed their resumption under new policies and procedures.

None of the above proves that CSE has been analyzing Canadians' call records. But with NSA examining U.S. records, you can bet that CSE at the very least has taken a good, hard look at the possibility of doing the same in Canada. And some of the above certainly suggests that they may have gone well beyond just considering the possibility.

When the question of whether CSE was data mining Canadian call records came up in 2006, CSE was quick to make a perhaps carefully worded denial. This time around, not so much (Mitch Potter & Michelle Shephard, "Canadians not safe from U.S. online surveillance, expert says," Toronto Star, 7 June 2013):

the Toronto Star contacted CSEC for comment Friday about its own metadata collection program, but received a boilerplate statement stressing that the agency is “prohibited by law from directing its activities at Canadians anywhere in the world or at any person in Canada” and “operates within all Canadian laws.”

“The Communications Security Establishment Canada (CSEC) cannot comment on its methods, operations and capabilities. To do so would undermine CSEC’s ability to carry out its mandate. It would also be inappropriate to comment on the activities or capabilities of our allies,” the statement said.

Which doesn't prove anything either.

[Update 10 June 2013: But it would appear that this article does prove that metadata monitoring is being done: Colin Freeze, "Data-collection program got green light from MacKay in 2011," Globe and Mail, 10 June 2013.]