Thursday, October 31, 2013

SIGINT lessons for Canada

Former senior Canadian diplomat Paul Heinbecker spells out five lessons for Canada from the recent Snowden revelations (Paul Heinbecker, "Five reasons our international eavesdropping isn’t worth the cost," Globe and Mail, 30 October 2013):
First, secrets are hard to keep in the digital world. The intelligence leadership and their political masters should presume that they will see their decisions on the front page of the Globe and Mail one day.

Second, intelligence is a means not an end, and not all its purposes – national security, counter-terrorism, communications security, commercial secrets and economic advantage – are equally compelling. Mature judgment is a must if sound decisions are to be made about the risks that are worth running – or not. For example, at a time when our Governor-General, Prime Minister, Foreign Minister, Trade Minister and other ministers had visited Brazil to court the government, was it really worth spying on the Brazilian Ministry of Energy and Mines, as we are alleged to have done?

Third, membership in the Five Eyes intelligence-sharing group (the US, UK, Canada, Australia and New Zealand), which dates from the end of the Second World War, entails costs as well as benefits and needs to be kept under sober review. Rubbing shoulders with the American intelligence community can be intoxicating, a poor condition in which to make important judgments.

Fourth, intelligence can be and frequently is over-rated. Spending on intelligence and diplomacy needs to be re-balanced. While intelligence operates beyond the pale of international law, diplomacy is both legally sanctioned and uncontroversial, and effective, in its creation of trusting relationships, effective. It does not make sense at a time when intelligence expenditures have grown dramatically, and CSEC is erecting a billion-dollar building in Ottawa, that the Foreign Affairs department is selling off assets abroad to cover a shrinking budget.

Fifth, leadership matters. The key challenge is not so much to do things right as it is to do the right things. Oversight to ensure that Canadian laws are not being broken is important and needs reinforcement, but coherent, strategic policy leadership that ensures that the intelligence tail never wags the foreign policy dog is crucial. Technological capacity should never trump political judgment.
Written by a guy who, for many years of his career, was a direct recipient of CSE's product and so probably has a good sense of the usefulness or lack thereof of SIGINT.

[Update 11:50 PM: Apropos:

Paul Lewis, "NSA chief Keith Alexander blames diplomats for surveillance requests," Guardian, 1 November 2013
The director of the National Security Agency has blamed US diplomats for requests to place foreign leaders under surveillance, in a surprising intervention that risks a confrontation with the State Department.

General Keith Alexander made the remarks during a pointed exchange with a former US ambassador to Romania, lending more evidence to suggestions of a rift over surveillance between the intelligence community and Barack Obama's administration.

The NSA chief was challenged by James Carew Rosapepe, who served as an ambassador under the Clinton administration, over the monitoring of the German chancellor Angela Merkel's phone.

Rosapepe, now a Democratic state senator in Maryland, pressed Alexander to give "a national security justification" for the agency's use of surveillance tools intended for combating terrorism against "democratically elected leaders and private businesses".

"We all joke that everyone is spying on everyone," he said. "But that is not a national security justification."

Alexander replied: "That is a great question, in fact as an ambassador you have part of the answer. Because we the intelligence agencies don't come up with the requirements. The policymakers come up with the requirements."

He went on: "One of those groups would have been, let me think, hold on, oh: ambassadors."

SIRC on CSIS-CSEC nexus

The latest report from the Security Intelligence Review Committee (SIRC), the CSIS watchdog body, takes a skeptical look at the workings of CSIS-CSEC cooperation ("Info sharing between CSIS and CSEC concerns security watchdog," Canadian Press, 31 October 2013):
A federal review agency says sensitive information gathered by the Canadian Security Intelligence Service could be abused by Canada's allies due to lax sharing policies.

In its annual report, the watchdog that keeps an eye on CSIS flags concerns about what happens to intelligence that CSIS passes to the national eavesdropping agency, which in turn shares the details with foreign allies.

The report underscores the fact CSIS is collaborating ever more closely with Communications Security Establishment Canada, which has come under scrutiny lately due to its participation in the international Five Eyes alliance.

CSEC, which monitors foreign telephone, satellite and Internet traffic, shares information with the U.S. National Security Agency and counterparts in Britain, Australia and New Zealand.

The American NSA has been the subject of almost daily headlines due to leaks from former contractor Edward Snowden that have revealed the agency's vast surveillance of worldwide communications.

In its report, tabled in Parliament, the Security Intelligence Review Committee recommends CSIS develop clearer and more robust principles of co-operation with CSEC to ensure appropriate information sharing.
Full SIRC report here.

CSE's outgoing review commissioner also recently took a look at the CSIS-CSEC relationship.

Further comments will have to wait until I actually read the SIRC report.

Update 10:30 PM:

Lots of interesting elements in the report.

A few comments:
[SIRC's] review found that a number of challenges prevent CSIS and CSEC from fully capitalizing on the opportunities presented by the new proximity of their respective headquarters. For intelligence agencies faced with increasingly limited resources, shared services allow for efficient and effective resource management. Unfortunately, SIRC found that the initial expectations for shared services between CSEC and CSIS may have been too optimistic.

Although the new CSEC facility has not yet been completed—leaving open the possibility for greater-than-expected returns—to a significant extent, the potential efficiencies have thus far been offset by managerial issues, budgetary restrictions and complications related to CSEC site development.
Exactly what services was CSIS expecting to share with CSEC? The cafeteria? The staff gym? Security staff? I've wondered whether CSEC might share some of the enormous data processing and data storage facilities that are being built at its new headquarters complex, but I'm not at all sure that would be a wise idea.

As far as "budgetary restrictions" go, CSIS may be facing budget limits, but CSEC is currently enjoying the largest budget it has ever had, and of course it is also on the point of occupying that brand-new $1.2-billion headquarters.
More generally, SIRC found that CSIS and CSEC had gaps in understanding the other organization’s respective mandate and/or responsibilities.
Maybe they should intercept each other's communications!

OK, enough, I'm trying to be a serious pundit here.
This impediment to cooperation was raised at both the working and managerial levels across CSIS’s operational branches, and acknowledged at joint CSIS/CSEC meetings. Moreover, these gaps in understanding resulted in instances where CSIS policies or procedures were not followed, an outcome that could have negatively impacted operational risk.

For its part, CSIS acknowledged the challenges associated with overlapping mandates and, quite often, the unique demands of the overlapping activities involved in the deployment or use of sensitive CSEC technology or CSIS human sources. Solutions presented to SIRC to address these problems include further educating CSEC and CSIS operational desks on relevant policies, as well as the creation of a joint CSIS and CSEC senior management operational board to provide strategic-level management on these activities.
CSIS is a "security intelligence" agency, but as explained in the next paragraph of the report, s. 16 of the CSIS Act empowers CSIS to collect foreign intelligence in Canada at the request of the ministers of National Defence or Foreign Affairs. I have always understood -- possibly incorrectly -- that this provision exists primarily to provide the authority for CSIS to assist CSEC with foreign intelligence collection against targets such as foreign embassies in Ottawa. However, the SIRC report strongly suggests that CSIS views this provision as giving CSIS a foreign intelligence mandate of its own, and that CSIS can then call on CSEC for its help in collecting such intelligence:
As a result of the varying accounts provided by CSIS on this issue, SIRC cautioned the Service to be prudent when deciding the extent to which it continues to seek CSEC’s assistance in the Section 16 process. Unless changes to the CSIS Act are made, CSEC, not CSIS, remains the organization primarily mandated with providing the Government of Canada with foreign intelligence information.
The distinction between foreign intelligence and security intelligence may in many ways be an artificial and not entirely satisfactory one, but it is fundamental to the systems that ostensibly are in place to protect the privacy of Canadians, so it seems to me that CSIS's efforts to blur that line, or to transcend it entirely, ought to be examined very, very carefully.
Normally, whenever CSIS shares information, it uses caveats and/or assurances. Caveats stipulate that the information being provided is CSIS property and cannot be forwarded to another agency or altered without CSIS’s direct consent. Assurances are formal, bilateral agreements made with foreign agencies stipulating that CSIS’s information will not be used in a manner that runs contrary to international human rights conventions. The extent to which caveats and assurances are effective depends on the degree of trust between CSIS and the agency receiving the information.
No, it does not. It depends on the degree to which the foreign agency lives up to its agreement and respects CSIS's caveats. To acknowledge that CSIS relies on trust to assess that effectiveness is simply to acknowledge that, in most cases, CSIS is either unwilling or unable to verify the other agency's compliance.
SIRC found... that a significant risk of increased HUMINT to SIGINT collaboration is the potential erosion of control over the information shared.

The Committee reached this conclusion because CSIS’s caveats and assurances were never designed for SIGINT collection. Unlike HUMINT agency collection, which is often done in isolation (i.e. collecting information from a human source and, if desired, subsequently sharing that information with an allied agency), SIGINT collection is instead more of a collective undertaking. CSEC belongs to a special alliance that includes the United States National Security Agency, the United Kingdom’s Government Communications Headquarters, the Australian Defence Signals Directorate, and the New Zealand Government Communications Security Bureau. The CSEC Commissioner’s Office, in its 2011–2012 annual report, described these partnerships as being potentially “more valuable now than at any other time, in the context of increasingly complex technological challenges.”

For its part, CSIS believes that exchanges with CSEC are low-risk endeavours. This is premised on the fact that allied SIGINT agencies, irrespective of the broad sharing that transpires among them, are primarily focused on their own national intelligence priorities. However, of concern to SIRC are those instances when allied collection priorities have coalesced with Canada’s—such as in counter-terrorism cases.

Although ministerial direction to CSIS and associated Service policies are designed to prevent the misuse/abuse of information, both from a security and human rights perspective, it is not clear how CSIS can comply with ministerial direction stipulating that caveats must be used when sharing information with domestic and foreign recipients, when SIGINT collection and dissemination functions run contrary to this expectation.

CSIS has acknowledged to SIRC that addressing these concerns is a complex subject that remains a work in progress; considering that the collaboration between CSIS and CSEC is increasing, SIRC will revisit this issue in subsequent reviews in order to assess what progress has been made in addressing this challenge.
It is not clear to me what information CSIS is sharing with CSEC in this respect, other than basic targeting information, such as name, location, telephone number(s), e-mail address, etc., and the judicial warrant or other policy basis justifying the targeting. Still, I think this is an important concern, as the Five Eyes' SIGINT collection system operates in large part as a single, integrated machine, and the introduction of any person as a target into that system has the potential to draw the attention of the intelligence communities of all the participating governments to that individual. When that happens, CSIS does not control whether the CIA subsequently decides that that person should be kidnapped and delivered to Syria for torture (as in the case of Maher Arar) or assassinated by drone.
The final section of the review identified an anomaly of the CSIS/CSEC relationship, namely, a noted lack of cooperation on cyber security. In 2010, Public Safety Canada created a whole-of-government strategy, the Cyber Security Strategy, which asserts that there can be no ambiguity in terms of who does what. The Strategy confirms the respective roles of CSEC and CSIS: the former has the recognized expertise in dealing with cyber threats and attacks, while the latter is broadly tasked to analyze and investigate domestic and international threats. The Strategy notwithstanding, SIRC’s review found that there is still work to be done to coordinate CSIS’s cyber-related activities with CSEC, especially with respect to the protection of information and infrastructures of importance to the Government of Canada.
It sounds like this may be an area of on-going rivalry between the two agencies. I have been wondering how CSEC can work effectively in this area without extensive monitoring of cyber activities in Canada, since cyber threats can emanate from inside Canada, or appear to emanate from inside Canada, as well as from abroad. It is in fact the case that CSEC can utilize Canadian Internet data and metadata in the course of carrying out its Mandate (b) activities, but it is not at all clear how extensive its collection and use of such data actually is.

More generally, the SIRC recommended that
Given the inevitability of growth in CSIS/CSEC collaboration, SIRC recommends that CSIS develop clearer and more robust overarching principles of cooperation with CSEC. These principles should address the growing volume of challenges that have arisen between the two bodies, while respecting the individual mandates of each organization.
The SIRC also examined CSIS's "new power", granted by judicial decision in 2009, to draw on the resources of "domestic partners", notably CSEC, to monitor CSIS targets who have temporarily or permanently left Canada.
In order to maximize collection under the new warrant power, CSIS, in almost every case, leverages the assets of the Five Eyes community (Canada, plus the United States, the United Kingdom, Australia and New Zealand). SIRC noted that even with the assistance of allies, the collection or intelligence yield under this power has provided different gains and challenges than the Service initially expected.

The arrangements with partners and allies also present possibilities for other agencies to act independently on CSIS-generated information. In practice, if an allied agency were to pick up intelligence on a Canadian citizen, a Canadian agency would ideally take the lead based on an informal agreement governing interactions amongst the Five Eyes partners. Nonetheless, it is understood that each allied nation reserves the right to act in its own national interest. National security legislation in both the United States and the United Kingdom, for example, gives these countries the authority to retain and act on intelligence if it relates to their national security, even if it has been collected on behalf of another country, such as Canada.

...

The risk to CSIS, then, is the ability of a Five Eyes partner to act independently on CSIS-originated information. This, in turn, carries the possible risk of detention or harm of a target based on information that originated with CSIS. SIRC found that while there are clear advantages to leveraging second-party assets in the execution of this new warrant power—and, indeed, this is essential for the process to be effective—there are also clear hazards, including the lack of control over the intelligence once it has been shared.
See comments above.
SIRC has seen indications that the Service has started using caveats that require allied agencies to contact CSIS in the event that information based on Service information is to be acted upon. The caveats, as they currently stand, are still considered a “work in progress” by the Service, but they do not yet address the wider reality of this type of collection. Nonetheless, they are a useful tool and do provide some measure of CSIS coverage. This coverage, however, comes with several challenges, including control of the information CSIS seeks to collect. SIRC advised CSIS to devise appropriate protections for the sharing of Service information, and to keep itself as informed as possible concerning the potential uses of CSIS information.

Moreover, for the most part, these caveats, as part of the wider “assurances” regime, were only considered with regard to one partner. Therefore, SIRC recommends that CSIS extend the use of caveats and assurances in regards to this new warrant power to include the agencies of the entire Five Eyes community, in order to ensure that no dissemination occurs without the Service’s knowledge.
Finally, the SIRC called for a shift in its authority to assess the work of CSIS:
[S]ince our 2010–2011 Annual Review, SIRC has put forward an argument that its current limitations in the area of review—that is, limited to CSIS’s information holdings and personnel—is falling increasingly out of step with the modus operandi of contemporary intelligence. Greater cooperation with domestic partners and more comprehensive regimes of information sharing mean that CSIS’s investigations now feed into and receive feedback from an increasingly large network. This theme spans the majority of reviews this year, and was evident in regard to the RCMP, DFAIT, DND, CBSA and, in particular, CSEC. Moreover, all government departments and agencies—to say nothing of Canada’s close allies—are becoming more technologically integrated. Governments across the Western world have responded and adapted, further integrating formerly separate intelligence capacities. As the technological barriers between information systems and previously stove-piped databases continue to fall, the sharing of data has become not merely possible, but routine. ...

As CSIS moves to take advantage of this new capacity, SIRC must also be able to respond. It must be flexible enough to follow up and effectively review CSIS activities and investigations, even when they cross over with other agencies and departments. Given the inevitability of technological interconnectivity, SIRC must be ready with the legislative tools and matching government resource commitments to ensure that the checks and balances enshrined in the Committee remain relevant and effective.
CSE Commissioners have also noted the importance of being able to properly assess the nature and consequences of joint CSIS-CSEC operations, and the difficulty of conducting such an assessment when the mandate of the reviewing office extends to only one of the agencies. Many of the most important questions concerning the privacy of Canadians occur in the area where foreign intelligence and security intelligence activities overlap, and it is clear that both review bodies have recognized that improvements in the monitoring of these activities are needed.

Google this!



Google's engineers "exploded in profanity," we're told, when they learned that NSA and friends are snooping on the unencrypted files of Google users as they are transmitted between various Google data centres around the world. The Washington Post story that revealed the program also reported that Yahoo data is also intercepted in this way (Barton Gellman & Ashkan Soltani, "NSA infiltrates links to Yahoo, Google data centers worldwide, Snowden documents say," Washington Post, 30 October 2013).

I understand the swearing, but did Google et al. really think these data streams wouldn't be subject to monitoring by NSA and, at least potentially, a lot of other countries' intelligence services?

Later in the article it is reported that
Last month, long before The Post approached Google to discuss the penetration of its cloud, Eric Grosse, vice president for security engineering, said the company is rushing to encrypt the links between its data centers. “It’s an arms race,” he said then. “We see these government agencies as among the most skilled players in this game.”
So they're not entirely dim. But surely this should have been done from the beginning.

Tuesday, October 29, 2013

It's $422,207,847 !

Why does everyone seem to think that the budget of the Communications Security Establishment is $350 million this year?

Perhaps because CSE itself helpfully provides that figure on its website? Could be...

The agency's actual budget for this fiscal year is $422 million. You can look it up.

[Update 9 November 2013: Make that $460,887,980.]

To be fair to CSE, its webpage does say that the "approximately $350 million" figure it quotes was the agency's budget in fiscal year 2012-13.

Which means that it's still wrong, but not by quite as much.

(CSE's FY 2012-13 budget was shown as $387 million in the Main Estimates of that year, but its actual expenditures that year are now estimated to be about $416 million.)

[Update 31 October 2013: The final numbers for 2012-13 are now in: $414.5 million (see Vol. 2 of the Public Accounts of Canada 2013)]

Oversight calls ignored

Not all Canadian senators have been seized with the prime minister's sudden desire to send for the tumbrels before the trial. Some have been paying attention to other news stories, and among that number are several who argued last week in favour of increased parliamentary oversight of CSE.

You can read the debate here: Debates of the Senate (Hansard), 24 October 2013.

Tl;dr: "Listen" was said a lot, but very little listening was done.

(H/T to Alex Pensato.)

[Update 3 November 2013: More non-answers on oversight and other issues here: Debates of the Senate (Hansard), 28 October 2013.]

In a similar vein, earlier today NDP defence critic Jack Harris sought, but failed to achieve, the unanimous consent of the House of Commons for the following motion:
That (a) a special committee on security and intelligence oversight be appointed to study and make recommendations with respect to the appropriate method of parliamentary oversight of Canadian government policies, regulations, and activities in the area of intelligence, including those of all departments, agencies, and review bodies, civilian and military, involved in the collection, analysis, and dissemination of intelligence for the purpose of Canada’s national security; (b) in the course of its work the committee should consider the methods of oversight adopted by other countries and their experiences and make recommendations appropriate to Canada's unique circumstances; (c) the Committee be composed of 12 members, 7 from the Conservative Party, 4 from the New Democratic Party, and 1 from the Liberal Party, to be named following the usual consultations with the Whips and filed with the Clerk of the House no later than November 8, 2013; (d) the Chair be a member of the Conservative Party and that there be one Vice-Chair from each of the opposition parties; (e) the first meeting be held before November 22, 2013; (f) membership substitutions be permitted to be made from time to time, if required, in the manner provided for in Standing Order 114(2); (g) changes in the membership of the special committee be effective immediately after notification by the Whip has been filed with the Clerk of the Committee; (h)the special committee be granted all of the powers of a standing committee, as provided in the Standing Orders; and (i) the special committee report its findings and recommendations to the House no later than May 30, 2014.

Canadian embassies host "covert technology"?

Further to the question of STATEROOM collection from Canadian diplomatic facilities, presumably it is the existence of these covert installations that explains the presence of a Head of Covert Technologies and Deployment and one or more Engineering Technologist of Covert Technology and Deployment on CSE's staff, as noted in Public Service Labour Relations Board decision 2009 PSLRB 121.

Monday, October 28, 2013

CSE still operating embassy collection sites



An excerpt from an NSA document published as part of Der Spiegel's coverage of NSA spying on Germany confirms that CSE is still operating covert SIGINT collection sites in Canadian diplomatic facilities ("Der unheimliche Freund," Der Spiegel, 44/2013).

According to the document, such sites are codenamed STATEROOM by the Five Eyes agencies.

The document states that
SIGINT agencies hosting such sites include SCS (at U.S. Diplomatic facilities), Government Communications headquarters or GCHQ (at British diplomatic facilities), Communication [sic] Security Establishments [sic] or CSE (at Canadian diplomatic facilities), and Defense Signals Directorate or DSD (at Australian diplomatic facilities). These sites are small in size and in number of personnel staffing them. They are covert, and their true mission is not known by the majority of the diplomatic staff at the facility where they are assigned.
As I noted here, according to Mike Frost, Canada established a number of permanent embassy collection sites beginning in the early 1980s. (Frost's book also reported that an earlier collection site was operated briefly in the Canadian embassy in Moscow during the early 1970s.)

[Update 29 October 2013: Colin Freeze, "Canada involved in U.S. spying efforts abroad, leaked document says," Globe and Mail, 29 October 2013]

[Second update 29 October 2013: Jim Bronskill, "Canada Using Embassies For Spying Purposes Abroad: Der Spiegel," Canadian Press, 29 October 2013]

[Third update 29 October 2013: Pour mes lecteurs français : Jim Bronskill, « Le CSTC se sert des ambassades pour espionner, selon Der Spiegel », La Presse, 29 octobre 2013]

[Update 30 October 2013:
Lauren Strapagiel, "Canadian embassies in U.S.-led spying efforts: Der Spiegel documents," Canada.com, 29 October 2013
Nicolas Bérubé, « Des espions cloîtrés dans les ambassades canadiennes », La Presse, 30 octobre 2013]

[Update 31 October 2013: Sun News joins the party with more nonsense from a retired CSIS officer. Daniel Proussalidis, "Canada's embassies use special communications equipment," Toronto Sun, 30 October 2013. I hope CSIS is suitably embarrassed, because if people get the idea that the government pays for this kind of analysis? I mean, damn.]

Sunday, October 27, 2013

Is Stephen Harper also an NSA target?

A couple of news stories speculating on whether Prime Mnister Harper will also turn out to be an NSA target:

Jim Bronskill, "U.S. tapping Stephen Harper's phone? Unlikely, says intelligence expert," Canadian Press, 26 October 2013

Jessica Murphy, "Canada could be drawn into U.S. spying controversy," Sun News, 25 October 2013

Wesley Wark, quoted in the Bronskill piece, considers it unlikely that Stephen Harper will turn out to be a target (as does Roland Paris in the Murphy article), although Wark concedes it might happen under extreme circumstances.

There does indeed seem to be an agreement among the UKUSA SIGINT agencies that they will not spy on each other, although where exactly the lines of what they may consider acceptable conduct are drawn is unclear, and whether this agreement is always honoured remains a question.

Certainly, none of the documents leaked by Edward Snowden that have been revealed to date have provided any indication that NSA is monitoring the leaders of its Five Eyes partners. This suggests either that there are no such indications in those documents or that there has been a deliberate decision by the journalists working with those files to withhold that bombshell -- and it certainly would be a bombshell -- for a future date.

Still, a number of former Canadian security officials have suggested that NSA probably does target Canada and that Canadians would be naive to believe otherwise.

In any case, Canadians would do well to remember this BOUNDLESS INFORMANT chart, which demonstrates that NSA does indeed have access to a significant amount of information about Canadian communications.

Indeed, NSA's access to Canadian Internet communications appears to be nearly as great as its access to Mexican Internet communications, and it is clear that Mexico is an important NSA target.

Friday, October 25, 2013

CSEC on the need to adapt to threats to "economic profile"

From the History page on the Communications Security Establishment Canada website:
The end of the Cold War brought with it the end of an era of superpower posturing with apocalyptic weapons of mass destruction, giving general public opinion a false sense of relief after the dissolution of the Soviet Union. In fact, the global intelligence community has had to adapt to new and, at times, even greater threats to their respective national security and economic profiles.

The end of privacy?



Embassy and the Canadian International Council’s digital magazine, OpenCanada, have partnered to publish an online, interactive version of Embassy's Security Policy Briefing related to Canadian privacy in the post-Snowden age: The End of Privacy?

Lots of good reading there on various aspects of the issues from a range of authors.

Thursday, October 24, 2013

NATO to improve cyber defences

From the Global Security Newswire ("Hagel: NATO Must Do More to 'Deal with' Cyber Attacks," GSN, 24 October 2013):
NATO defense ministers agreed this week that they must "do more to deal with cyber threats," U.S. Defense Secretary Chuck Hagel said on Wednesday, as the alliance prepared to launch a new cyber-defense center next week.

Cybersecurity was one of the main topics defense leaders from the 28-nation NATO discussed on Tuesday and Wednesday during a two-day ministerial in Brussels. Hagel on Wednesday told reporters that the alliance's new cyber-defense system -- the Computer Incident Response Center -- "is on track to achieve full operational capabilities next week."

"The U.S. supports a proposal for the center to have teams of NATO cyber experts that can be quickly deployed to assist allied nations if they request help in dealing with cyber intrusions or attacks," Hagel added. "It was agreed that the alliance must do more to deal with cyber threats, and this will remain a top priority going forward."
The way I imagine this discussion playing out, the ministers all agree on the need to improve their collective protection against threats such as cyber intrusions -- and then they all stare significantly at Defense Secretary Hagel and his Canadian and British "Five Eyes" counterparts.

Wednesday, October 23, 2013

News and commentary on the BCCLA lawsuit



Today's news: The hapless Sun News still hasn't discovered the difference between CSEC and CSIS.

Coverage of the British Columbia Civil Liberties Association's lawsuit against the Communications Security Establishment:

- "Canadian spy agency sued for allegedly violating charter," CBC News, 22 October 2013

- "B.C. civil liberties group suing government over CSEC eavesdropping claims," Canadian Press, 22 October 2013

- Gillian Shaw, "B.C. civil liberties group files suit against Canada's electronic surveillance agency," Vancouver Sun, 22 October 2013

- Jeremy Nuttall, "Canada's spy program sparks lawsuit from the BC Civil Liberties Association," QMI Agency, 22 October 2013

- Colin Freeze & Wendy Stueck, "Civil liberties groups launch lawsuit against Canadian eavesdropping agency," Globe and Mail, 22 October 2013

My comments on the case (for what they're worth):

I can't speak to the strength of the legal case being made, but I do think that the case has the potential to be very important.

The impression one might get from the BCCLA's statements is that all or most of the cross-border communications of Canadians are currently collected by CSEC. I believe that this is not this case, but we don't have any solid information as to what the actual percentage is or what it could be under the government's current interpretation of the law should it ever decide to expand such collection. This case might be very useful in clarifying where we stand.

Also, regardless of whether the percentage collected is large or small, I think it can still be argued that the Canadian communications that do get collected deserve better protection. Although it is difficult for technical reasons to demand that a judicial warrant be in place before the collection of any communication with one end in Canada, it might be possible to require that a judicial warrant be obtained before any communication subsequently determined to have one end in Canada is made available for analysis and use by the intelligence community.

Clarification of the degree of metadata collection about Canadians and the uses to which that data can be put could be even more important. We do not know the rules that govern the collection and use of domestic metadata by CSIS and other domestic security or law enforcement agencies. It could be the case that these agencies are able (or could be able with simple policy rather than legal changes) to obtain and use comprehensive metadata records without a judicial warrant, in which case CSEC would able to assist in data mining and network analysis of these records under its mandate (c). Even the more limited uses of metadata pertaining to CSEC's mandate (b) and mandate (a), information security and foreign intelligence respectively, could be highly intrusive. In the latter case, even if the metadata use were limited to some percentage of cross-border communications, the potential for invasion of privacy could be quite large.

It would be good to get a better understanding of the extent of the collection of this data and the uses to which it is being put and could be put under the government's interpretation of existing law, and to explore the degree to which the extent of collection and use of this data can be placed under judicial control.

Update 24 October 2013: Wesley Wark comments on the BCCLA case ("Suing for secret spying," Ottawa Citizen, 23 October 2013):
For Canadians, the BCCLA lawsuit may seem to be one more episodic moment in our fitful concern with balancing civil liberties and security. But it is more than that. The lawsuit may force, where nothing else has, much greater transparency around intelligence practices adopted after 9/11.

It should also force a real debate over privacy protections. Should a government agency like CSEC be allowed to collect “metadata” (essentially data that describes telecommunications networks and activity rather than the content of communications themselves) regarding Canadians? Should CSEC, with ministerial authorization only, rather than with a warrant or other judicial approval, be allowed to retain, use and even share with other government departments and foreign allies, the private communications of Canadians?

The BCCLA lawsuit has shone a light in a dark corner. From it may come a greater appreciation of how to protect our identities and rights as citizens of cyberspace. And from it may come a better appreciation of the need, and necessary limits, of intelligence-gathering by democratic societies.

Tuesday, October 22, 2013

Deibert on surveillance and the future of the Internet

Must-read speech by Ron Deibert on surveillance and the future of the Internet:
Some of my colleagues in civil society feel that citizens should “take the Internet back” — bypass or ignore governments and private companies altogether because they can no longer be trusted.

Not only is this impossible, it is undesirable.

Without organized government, without the rule of law, the very rights we cherish would quickly diminish in a Hobbesian world of might makes right.

Instead, I believe that civil society needs to put forward a security strategy for cyberspace from the starting point of human rights and the rule of law.

We have to begin by asking: security for whom? security for what?

Part of that process must involve a reasonable and open discussion about the rule of law enforcement and intelligence agencies in the world of Big Data and the Internet of Things.

At the very time that we are turning our digital lives inside out, entrusting our thoughts, actions, and intimate conversations to private companies, we are delegating power and authority to secure this space to some of the world’s most secretive and unaccountable national security agencies.

To be clear, law enforcement and intelligence agencies are essential to the protection of commerce, rights, and governance. But wholesale surveillance without independent judicial oversight is incompatible with liberal democracy and human rights.

Furthermore, we have to give meaning in the real world to the idea of “multi-stakeholderism.” The term is mouthed so often by those who do not practice what they preach that it has become an empty euphemism.

Finally, we have to lift the lid on the Internet and subject it from the bottom to the top, from the code all the way up to forums like this, subject them all to proper oversight, transparency, accountability, and legal restraint.

The Internet is ours — all of ours. It is what we collectively make of it. We need to remember that before it slips through our grasp.

Privacy Commissioner writes to CSE Chief



Privacy Commissioner Jennifer Stoddart hits CSE Chief John Forster with the full force of her powers:
[W]e believe that public trust is critical to any endeavour of government, including its intelligence and security mandates. We strongly encourage CSEC to be as visible and forthright as possible in the public debate now unfolding. To that end, if there is any opportunity for my staff to assist you as you continue to work on privacy-related issues, please do not hesitate to contact us.
Forster replies:
We will continue to look for opportunities to be as open and transparent as possible, within the constraints of national security and public safety. In that regard, I wish to thank you for your offer of assistance and would welcome continued collaboration between our organizations as CSEC moves forward on privacy-related initiatives.
Consult image above to determine when she can expect to hear from him again.

CSE sued by BCCLA

CSE is being sued by the British Columbia Civil Liberties Association:
On October 22, 2013, the BCCLA filed a lawsuit against the Communications Security Establishment Canada (CSEC) claiming that its secret and unchecked surveillance of Canadians is unconstitutional.

The BCCLA’s lawsuit calls on the government to come clean and state clearly who they are watching, what is being collected and how they are handing Canadians’ private communications and information. The BCCLA filed the case because we believe that secret and unrestrained government surveillance presents a grave threat to democratic freedoms.

The BCCLA’s lawsuit is the first challenge to the legality of CSEC’s spying programs.

CSEC’s Operations Infringe Canadians’ Rights

The BCCLA’s lawsuit argues that two aspects of the CSEC’s operations violate the Charter’s protections against unreasonable search and seizure: the interception of the private communications of Canadians and the sweeping collection of metadata information produced by Canadians.

By law, CSEC is permitted to read Canadians’ emails and text messages, and listen to Canadians’ phone calls, whenever a Canadian is communicating with a person outside Canada. CSEC also operates under a secret ministerial directive that allows it to collect and analyze the metadata information that is automatically produced each and every time a Canadian uses a mobile phone or accesses the internet.

There is no court or committee that monitors the CSEC’s interception of these private communications and metadata information, and there is no judicial oversight of its sweeping powers. CSEC’s operations are shrouded in secrecy.

The BCCLA filed this lawsuit to force the government to enact specific safeguards to protect the rights of all Canadians.
Press Release

Notice of Claim

Backgrounder

More on economic intelligence gathering III

Further to this and this, the current Chief of CSE, John Forster, also chose not to answer the question rather than say a simple "no" when offered the chance to confirm or deny gathering intelligence of value to Canadian companies (Proceedings of the Standing Senate Committee on National Security and Defence, 5 November 2012):
Senator [Joseph] Day: Would there ever be a situation where you would communicate intelligence or communication that you have developed directly to a Canadian company? For instance, you might learn about intellectual property being hijacked and stolen, or you might develop some information with respect to a takeover bid that would be of value to the Canadian company.

Mr. Forster: We generally provide intelligence to government departments. If there was a threat to a Canadian company, we would work with CSIS and the RCMP.

Senator Day: Should I play on the word "generally"?

Mr. Forster: No, no intention was implied. We would work with our domestic agencies — RCMP and CSIS — who have that responsibility for domestic.

Monday, October 21, 2013

CG = CANDLEGLOW?

A few days ago I was wondering about the meaning of the suffix CG in the Canadian SIGAD CAC-98CG.

But then I dredged the following out of my files:



It's a Personnel Evaluation Report for a member of the military Communicator Research trade who was assigned to 771 Communications Research Squadron in 1999-2000. I found it posted on the Internet.

771 Communications Research Squadron was disbanded in 2002, but at the time of this report its members primarily worked in the Sir Leonard Tilley Building, CSE's headquarters, alongside the civilian employees of CSE.

And so it would seem to have been for this individual, who evidently worked closely with the civilians in what was then CSE's G Group (which probably focused on SIGINT Acquisition).

The report shows that the subject was a communications satellite (COMSAT) Signal Research and Target Development (SRTD) analyst and that he focused in particular on computer to computer (C2C) communications. The satellite monitoring dishes used for this work are located at the nearby CFS Leitrim, and the report notes that he received a letter of appreciation from the commanding officer of Leitrim for some of the work he did.

The report also notes that he worked closely with a group of C2C analysts designated CANDLEGLOW.

Is the CG suffix in the CAC-98CG SIGAD an abbreviation for CANDLEGLOW?

The pieces would seem to fit.

CANDLEGLOW appears to have been a group of analysts working at CSE headquarters (which is consistent with the second C - for civilian - in CAC), using the facilities at Leitrim (consistent with the 98 in the SIGAD), and processing computer-based communications (consistent with the appearance of CAC-98CG on a list of sites collecting Internet-related traffic).

Update 26 May 2015: As noted here, CANDLEGLOW may be the overall designation for foreign satellite (FORNSAT) monitoring operations at Leitrim.

Sunday, October 20, 2013

More on economic intelligence gathering II

Further to this discussion, here is a very interesting exchange between then CSE Chief John Adams and Senator Tommy Banks in April 2007:
[John Adams:] Foreign intelligence means information or intelligence about the capabilities, intentions or activities of a foreign individual, state, organization or terrorist group as they relate to international affairs, defence or security. It is much broader than just security.

Senator Banks: Could that include communications between two foreign entities or persons having to do with commercial matters that are of interest to Canadian national interests?

Mr. Adams: You said it, not us.

Senator Banks: It is a question, though.

Mr. Adams: I cannot talk about what we target and what we do not target. It is dealing with international affairs.
I don't think you have to be a tinfoil aficionado to conclude that Adams's you-might-think-that;-I-couldn't-possibly-comment answer was tantamount to confirmation that CSE does at least sometimes target "commercial matters that are of interest to Canadian national interests".

And there seems to be little doubt that Senator Banks understood it that way as well. (He certainly didn't take it as a denial.) In a recent op/ed, the now retired senator dismissed the reactions of Prime Minister Harper and opposition leader Thomas Mulcair to the Brazil revelations as "disingenuous phoniness on the part of people who certainly know better" (Tommy Banks, "Opinion: Canada needs watchdog over spy agency," Edmonton Journal, 14 October 2013):
I’m pretty sure that the person riding home on the 5 p.m. bus understands that in our national interests, Canada carries on intelligence-gathering and analysis, very much including commercial intelligence, just like every other industrialized nation.
Another senator who was present on the day Adams made his comments, Colin Kenny, also recently expressed his views on this question (Colin Kenny, "Is Canada Being Polite Enough When it Comes to Espionage?" Huffington Post, 15 October 2013):
CSEC defends Canadians against international hackers and does electronic snooping around the world, for reasons of security, and yes, for reasons of ultimately securing economic advantage for Canadian firms, although it will deny the latter. ...

Agencies like CSEC and CSIS clearly deem it to be part of their mandate to help Canadian companies stay competitive in various fields, less we shed still more of the hundreds of thousands of full time jobs this country has lost to foreign competition early in this new century.
Clearly, if CSE was not collecting economic intelligence in 2007, Chief Adams botched his opportunity to point that out rather badly.

Thursday, October 17, 2013

Forcese on legality of CSE's operations

University of Ottawa law professor Craig Forcese has written a fascinating and highly useful explanation of some of the legal issues pertaining to CSE's foreign-intelligence operations and use of metadata ("A Tale of Two Controversies: Thoughts on CSEC’s Headline Act(s)," National Security Law blog, 16 October 2013):
Over the last half year, Canada’s once largely unknown signals intelligence agency has twice become a veritable media blockbuster. In both instance instances, this notoriety arises as a collateral consequence of the Snowden datadump on US signals intelligence and intercept practices.

Last summer, the Globe and Mail focused on CSEC’s metadata intercept practices, during a time in which the US National Security Agency’s equivalent conduct was under the microscope. More recently, documents obtained directly from Snowden seem to disclose covert surveillance of some sort by CSEC on the Brazilian ministry of mines, perhaps undertaken as part of the “five eyes” signals intelligence alliance between Canada, the United States, the United Kingdom, Australia and New Zealand.

In this brief talk, I wish to briefly identify several legal issues these two controversies raise. ...
It's worth your time to read the entire article, which is brief even by the standards of normal people, let alone those of lawyers.

Some comments/questions:

As Forcese points out, the Brazil operation was fundamentally a foreign intelligence operation, and he provides an interesting introduction to the legal environment pertaining to such foreign intelligence-gathering.

But I have to quibble a little with his characterization of the Brazil case as one with no "domestic nexus". As I pointed out here, some of the communications analyzed by CSE had one end in Canada and thus did involve Canadians or persons in Canada. These communications were therefore "private communications" under Canadian law. We do not know whether these "private communications" were actually intercepted or only their metadata was examined. If their content was also examined, presumably CSE relied on one or more of the Ministerial Authorizations that govern the monitoring of various forms of communication to render this activity legal.

Still, I can see the value of restricting the Brazil discussion to the laws pertaining to foreign intelligence and reserving the discussion of "private communications" for the second section of the piece, in which Forcese addresses the issues related to domestic metadata and domestic communications.

The metadata portion of the discussion addresses only mandate (a) operations, but it is worth noting that CSE analyzes metadata under its mandates (b) and (c) as well. The extent of the monitoring conducted under those mandates is unknown.

Forcese:
Having reviewed heavily redacted documents obtained from CSEC and other government agencies on CSEC metadata collection, it would appear (although one can’t be certain) that CSEC has not sought or received ministerial authorization in relation to metadata collection. Instead, it collects pursuant to a ministerial directive and internal policy.
I think this is correct. As the CSE Commissioner reported here (PDF p. 9), “Metadata is not [one line redacted] a private communication as defined in the Criminal Code. CSEC does not require a ministerial authorization to conduct metadata activities [2-3 words redacted] because these activities do not involve private communications.” The redactions in these statements make it impossible to be certain that this interpretation is absolute and uncontested (the redacted portions might outline exceptions or record dissenting views), but the gist of CSE's overall approach to metadata seems clear.

Forcese:
If this is so, this must mean that CSEC and its Justice lawyer advisors are confident that metadata collection does not implicate incidental collection of private communication. My suspicion, reading between the heavily redacted lines in these documents, is that this view in turn reflects an understanding of metadata as something other than “communications”.

Private communication, under the Criminal Code, is any oral communication or any telecommunication. The government legal theory must be, therefore, that metadata – data about data – is neither an oral communication nor a telecommunication. This theory depends, on other words, on an interpretation of the Act that limits its reach to content and not the superstructure around that content (e.g., who was called, when from what location and number, for how long etc.), even if that superstructure is, in turn, quite informative. This may be a plausible legal hypothesis, but one upon which much turns: unauthorized intercept of private communication is a crime.
I have a couple of questions in this regard that perhaps Professor Forcese can answer for the legal ignoramuses (ignorami?) such as myself out here in the general public.

The metadata associated with communications are not random numbers transmitted for no reason. They are in fact communications between telecommunications companies/providers or separate offices of the same company transmitted for addressing and billing purposes and perhaps sometimes for corporate data-mining purposes as well. In the case of telephone communications, they run (or ran) in a dedicated communications channel called Signalling System 7, which is specifically targetted by SIGINT agencies. If at least one end of the associated communication is in Canada, then it is a pretty safe bet that in a large percentage of cases at least one recipient of the metadata communication also resides in Canada. Why are these communications of metadata not "private communications"? Is it possible that these communications are being obtained with the express or implied (say, through regulatory fiat) permission of the telecommunications companies, and thus that no additional legal authority is required?

Forcese:
In 2005, CSEC’s review body, the commissioner of CSEC, suggested that there were some collection activities undertaken under Mandate A that should have been undertaken under Mandate C. Mandate C – assistance to law enforcement and domestic security intelligence agencies – depends on these bodies being themselves authorized to collect information. In practice, that typically would mean a warrant under the Criminal Code or the CSIS Act.

What we don’t know is what exactly CSEC did under Mandate A that should have been done (in the commissioner’s eyes) under Mandate C. One suspects that if the Commissioner concluded that Mandate A was inapplicable, this was not about collection of foreign intelligence.
This is a very interesting case. Forcese is certainly correct that we don't know exactly what CSE was doing in this instance. One possibility, however, is that CSIS and the RCMP were providing the names and contact information ("selectors") of Canadians/persons in Canada that they were investigating to CSE and asking CSE to map out the foreign contacts of these individuals extending one or two hops out (i.e., including the foreigners with whom the foreign contacts were themselves in contact). Insofar as such communications would be either cross-border or entirely foreign, the argument could be made that they were foreign-intelligence-related, and thus were appropriately a mandate (a) activity. However, insofar as such a network would in fact be centred on a Canadian/person in Canada and the analysis would have been undertaken in order to provide information relevant to investigation of a subject in Canada, it could be argued at least as compellingly that such information is not "foreign intelligence" but intelligence related to Canadians/persons in Canada.

Whatever the real facts of the dispute may be, CSE revised its procedures related to such activities "significantly" in 2008, and a subsequent review by the CSE Commissioner of activities conducted after the changes were made agreed that they were now appropriately authorized under mandate (a) (see PDF page 18 of these documents):
The [redacted] conducted by CSEC during the period under review were appropriately authorized under part (a) of CSEC’s mandate. With the significant changes made to these activities as described in the background section of the report and as summarized on the next page, the Commissioner has no questions like those raised in previous reviews as to whether such activities would be more appropriately authorized under part (c) of CSEC’s mandate. The new processes put in place and followed by CSEC for the activities conducted during the period of review are assessed as consistent with part (a) of CSEC’s mandate.
It is perhaps reassuring that this particular dispute between the CSE Commissioner and CSE is now apparently resolved.

But there is something I find disturbing about these documents. In the end, the CSE Commissioner never expresses an official judgement on the appropriateness (and thus the legality) of CSE's approach to these activities prior to the 2008 changes.

We are left with the distinct impression that the Commissioner's office remains of the view that the pre-2008 activities were not appropriately authorized under mandate (a), but the issue is dropped.

Is this how our watchdog works? No judgement of legality is made for years because the government disputes the Commissioner's view, and then the issue is dropped because CSE stops doing things in the way that caused the concern in the first place?

How many other times has CSE broken the law in the view of Commissioners and then escaped being held accountable because the activities in question were subsequently modified or halted?

Tuesday, October 15, 2013

National Post fuzzifies the muddification

The bewildered National Post attempts to explain CSEC to the Canadian public (Adrian Humphreys, "How Canada spies: A guide to the sometimes obscure acronyms of our intelligence world," National Post, 11 October 2013):
Officially, the Communications Security Establishment Canada is an arm of the military, although it largely operates independently. “It’s placed within the Department of National Defence largely as a kind of cover, to help bury its budget in the immensity of the DND budget,” says Prof. Wark. As evidence, CSEC reports to DND for financial and administrative matters and to the PCO for policy and operational matters.
Where to begin.

CSEC is not an arm of the military and it has never been one. Until November 2011 it was a civilian agency of the Department of National Defence. It is now a stand-alone agency. It still reports to the Minister of National Defence and is still considered to be part of the Defence portfolio, but it is no longer a part of the Department of National Defence.

Prior to November 2011 it reported through the Deputy Minister of National Defence for financial and administrative matters and the National Security Advisor in the Privy Council Office (PCO) for policy and operational matters. It now reports directly to the Minister. DND and the PCO are now both out of the loop.

(In the National Post's defence, it is worth noting that even the last Minister of National Defence found the distinction confusing.)

It is true that CSE's budget was hidden within the much larger DND budget for the first 20 years following CSE's 1975 transfer to the Department of National Defence (indeed, it has also been suggested that its budget was hidden within the DND budget even before the agency's transfer to DND, while it was still the Communications Branch of the National Research Council.)

But DND stopped hiding CSE's budget in the mid-1990s. For more than 15 years CSE's annual overall budget and the breakdown of that budget into personnel, operations and maintenance, and capital expenditures were published in DND's Report on Plans and Priorities, the departmental part of the annual budget estimates documents. The reporting also usually included a description of the agency, some general discussion of its priorities, current staffing figures, and sometimes some information on the status of major projects, such as the construction of its new headquarters complex.

CSE's overall budget is still published every year. But now that the agency has its own stand-alone status it appears separately in the Main Estimates document (pp. 113-114). CSE no longer appears at all in the DND Report on Plans and Priorities, and it does not publish its own Report on Plans and Priorities (or Departmental Performance Report or Annual Report). The agency now reports very little beyond its overall budget number.

It has thus become significantly less transparent in its public reporting in the two years since it left DND.

(In the grand tradition of flacks everywhere, CSE's spokesthing responded to coverage of this change by claiming that CSE had actually "enhanced" its public reporting. I guess there must have been an asterisk of some kind attached to that statement as well.)

More from the National Post:
[CSE] is often called Canada’s electronic eavesdropping agency, as it’s the main gatherer of foreign signals intelligence by listening to and monitoring electronic communication.
Its SIGINT mandate also extends to hacking into and stealing computer files, as indicated by the wording of part (a) of its mandate: "to acquire and use information from the global information infrastructure".
Another job is Canada’s cyber security, protecting Canada’s telecommunications.
For the most part, it does not seek to protect the telecommunications of Canadians, but it is tasked under mandate (b) "to help ensure the protection of electronic information and of information infrastructures of importance to the Government of Canada".
As a top-tier part of Canada’s intelligence apparatus with about 2,000 employees, it can lend technical and operational assistance, and equipment, to the RCMP and CSIS.
Such assistance, which can include intercepting the communications of Canadians and persons in Canada, is also provided to the Department of National Defence and the Canadian Border Services Agency.

CAC-98CG monitors Internet and/or IM traffic

This slide from yesterday's Washington Post article on contact list harvesting provides a nice demonstration of the level of integration in the operations of the "Five Eyes" signals intelligence agencies. It also indicates that at least one Canadian intercept site is collecting Internet and/or instant messaging traffic for the NSA and other "Five Eyes" partners:



The legend on the right of the slide shows the SIGADs of collection sites associated with all five of the agencies, the U.S. National Security Agency, Britain's Government Communications Headquarters, Australia's recently renamed Australian Signals Directorate (formerly Defence Signals Directorate), New Zealand's Government Communications Security Bureau, and Canada's Communications Security Establishment Canada.

A number of DS- sites are also listed. The Washingon Post interprets these sites as Australian (presumably on the assumption that DS refers to Defence Signals), but I don't think that interpretation is correct. Australian SIGADs all begin with AU, like the two Australian SIGADs that can be seen on the slide above.

I don't know what DS- refers to, but I would guess that it probably means something like Data Source -- possibly data purchases from telecommunications companies? [Update 8:25 pm: The Top Level Communications blog suggests "Distribution System", which seems like a good theory, but the exact nature of these sources is still unclear.]

One of the DS- sites listed, DS-800, was a major source of the telephone and Internet metadata used in CSE's analysis of the Brazilian Ministry of Mines and Energy's communications.

There is one Canadian SIGAD listed, CAC-98CG. The C following the CA indicates that the site is civilian operated, presumably by CSE itself.

The military-operated site at Canadian Forces Station Leitrim is or was designated CAF-98. The fact that both sites have the same numerical designator may indicate that CAC-98CG is also located at Leitrim, or perhaps elsewhere in nearby Ottawa. The letters that follow the 98 (i.e., CG) may indicate a detachment associated with the main site.

[Update 21 October 2013: One possibility is that CG is an abbreviation for CANDLEGLOW.]

I'm in ur contact list harvesting ur d00ds

From the Wapo (Barton Gellman & Ashkan Soltani, "NSA collects millions of e-mail address books globally," Washington Post, 14 October 2013):
The National Security Agency is harvesting hundreds of millions of contact lists from personal e-mail and instant messaging accounts around the world, many of them belonging to Americans, according to senior intelligence officials and top-secret documents provided by former NSA contractor Edward Snowden.

The collection program, which has not been disclosed before, intercepts e-mail address books and “buddy lists” from instant messaging services as they move across global data links. Online services often transmit those contacts when a user logs on, composes a message, or synchronizes a computer or mobile device with information stored on remote servers.
Read the full article.

Documents cited in the article can be found here, here, and here.

Sunday, October 13, 2013

New photo of new CSE headquarters

Here's Chuck Clark's latest air photo of the new CSE headquarters complex.



Chuck's comment: "Looks like they're finally almost done with their tinfoil roof."

Thanks for the update!

Older photos here.

Saturday, October 12, 2013

September 2013 CSE staff size

2113.

(If you click through on the link and get a different figure, it's probably because the Canada Public Service Agency has updated its website; they update the numbers once a month.)

Friday, October 11, 2013

More on economic intelligence gathering

Interesting discussion of what Canada may have been up to in Brazil here (Erica Alini, "Canada, Brazil and how snoops are threatening free trade," Maclean's, 10 October 2013):
Why on earth were we snooping (or trying to snoop) on Brazil’s Mining and Energy Ministry of all things?

The hypotheses that have been floated so far are (a) that we were trying to steal information for the benefit of Canadian mining and energy firms and (b) that we were after intelligence meant for government eyes only — maybe a useful backgrounder for trade negotiations.

[Wesley] Wark dismissed both of them. Hypothesis (a), he says, is implausible. Canadian intelligence agencies do not share information with private businesses — and it wouldn’t make any sense if they did, he told Econowatch. Private corporations in liberal democracies are independent beings, often with massive operations and headquarters in several countries and free to leave and re-incorporate somewhere else if they so wish. Why would a government trust these companies with information that could land it in serious trouble if intentionally or accidentally spilled? Second, big multinationals are quite capable of gathering their own information about market conditions and opportunities at home and abroad — it’s called, not by chance, business intelligence.
There's a lot of truth to these points, I think, but the Canadian economy is hardly a laissez-faire free-market neo-liberal Arcadia.

Canada had and to some extent still does have what are in effect state-owned businesses in such fields as nuclear technology and wheat sales, to name two that have been explicitly linked to economic intelligence-gathering in the past. The Canadian government also provides monetary or other assistance to a number of favoured industrial sectors, most notably the oil and other resource extraction sectors, but also the aerospace and defence sectors, whose success it considers crucial to Canada's economic future. Other industries, such as shipbuilding, would not exist without government support. Trade commissioners are posted to Canadian embassies to help Canadian businesses sell abroad. A Crown corporation, the Canadian Commercial Corporation, exists for the sole purpose of brokering and facilitating export sales by Canadian companies.

So, no, the Canadian government is not going to hand out highly classified signals intelligence reports to every Canadian company or multinational company with operations in Canada that is looking to sell abroad, but is it really that implausible that a helpful word might get whispered in a relevant ear on occasion when the stakes are especially high?
The hypothesis that CSEC collected information useful for Ottawa in some kind of future, hypothetical trade negotiation seems less of a pie-in-the-sky story, because there is some evidence that CSEC fetched just such intelligence in the mid-1990s. Wark, though, is unpersuaded. Nothing, he says, indicates that CSEC has been up to similar deeds since 9/11, when the agency acquired a heavy focus on global terrorism, weapons of mass destruction and conflicts zone [sic] where Canadian troops were engaged.
Hmm. I don't think I would go as far as to say nothing indicates that CSE has been up to such activities since 9/11, but it is certainly true that 9/11 did re-order the priorities of the Canadian intelligence community rather dramatically.

Perhaps not to the extent that CSE can no longer walk and chew gum at the same time, however.
Wark’s theory is that Canada was doing a favour to U.S. National Security Agency, a favour we felt we owed the Americans by virtue of our membership in the Five-Eyes, an intelligence alliance of Canada, the U.S., the U.K., Australia and New Zealand.
So we can walk and chew gum, as long as it's a favour for the NSA?

The five agencies do work extremely closely together, sharing personnel, technology, and facilities, dividing up tasks among themselves, and acting largely under the leadership of the NSA, although each agency also pursues its own national priorities. The fact that CSE was freely discussing the Brazil operation with its partner agencies, and enlisting the direct aid of NSA's Tailored Access Operations division, is a pretty strong indication that the information Canada was seeking in this case was not for the purpose of giving specific Canadian companies an advantage -- or at least not in those activities that might involve competition with U.S., British, Australian, or New Zealand firms. The information sought may well have been of a more generally useful nature to all of the partners, such as information on the extent and exploitability of Brazilian oil and gas reserves.

Given the current Canadian government's extraordinary and single-minded dedication to expanding exports of Canadian oil, if this kind of information was indeed the goal of the operation then I'm not convinced that the tasking came from NSA rather than the Canadian government itself. But who knows?
And why, then, did the Americans want to snoop on Brazil’s mining sector? Probably, just because they could, says Wark. Metadata collection analysis, which makes it possible to get a picture of the volumes and networks of telephone, email and Internet traffic across the globe, has given so called signals-intelligence agencies such as CSEC and the NSA enormous powers. The NSA, in particular, has amassed tremendous capabilities, and it has shown a propensity to test the limits of its new tools. “They probably weren’t interested in the content [of whatever they would find at the Brazilian Mining and Energy Ministry],” says Wark, “they wanted to see what they could do.”
I have a great deal of respect for Wesley Wark's expertise on intelligence issues. And I am entirely sincere in saying that, not engaging in ironic throat-clearing leading up to the obligatory "but".

But.

Everyone is so busy fighting the War on Terror, etc. that they don't have time for economic intelligence-gathering, but they do have time to screw around in the Brazilian Ministry of Mines and Energy's communications just for the hell of it?

Really?

Thursday, October 10, 2013

New privacy coalition formed

From this webpage:
OpenMedia.ca is joining with more than 30 major organizations and over a dozen leading experts to launch the largest pro-privacy coalition in Canadian history. With Parliament set to resume, the Protect Our Privacy Coalition has banded together to ensure Canadians get effective legal measures to protect their privacy against government intrusion.

The broad-based coalition includes organizations and individuals from a wide range of political perspectives, including citizen-based groups, civil liberties groups, privacy advocates, right-leaning organizations, First Nations groups, labour groups, small businesses, LGBT groups and academic experts, all of whom have signed onto this statement:
“More than ever, Canadians need strong, genuinely transparent, and properly enforced safeguards to secure privacy rights. We call on Government to put in place effective legal measures to protect the privacy of every resident of Canada against intrusion by government entities.”

Your metadata at work




I was re-examining this slide from the CSEC Olympia presentation when suddenly it hit me (head slap) -- some of the communications shown on this chart extend into Canada!

What we have here is a teachable moment.

Two communications (or perhaps collections of communications) in particular are labeled as connecting to Canada, one through Autonomous System Number (ASN) 6453 and the other through ASN 32613. The former is Tata Communications, a global communications provider largely built upon the facilities of the former Teleglobe. The other is iWeb Technologies, a Montreal-based service provider. The chart doesn't show who in Canada was ultimately at the other end of the communications, but it does make it clear they were in Canada.

Now, some of you may be thinking, didn't that nice man who heads CSE, Mr. Forster, just finish telling everybody that CSE can't listen to the communications of Canadians?

Wasn't he just quoted to that effect in the Globe and Mail (and probably a couple of dozen other places)?

Yes, indeed, he was (Steven Chase, "CSEC defends practices in wake of Brazilian spy reports," Globe and Mail, 9 October 2013):
I can tell you that we do not target Canadians at home or abroad in our foreign intelligence activities, nor do we target anyone in Canada. In fact, it’s prohibited by law. Protecting the privacy of Canadians is our most important principle.
So what gives?

Well, there's a reason why Mr. Forster and his fellows always use terms like "target" or "direct at" when issuing their blanket assurances.

You see, the operation depicted on the Olympia slide was directed at non-Canadians who were not in Canada. The targets of the monitoring were Brazilians in Brazil.

The fact that some of the communications analyzed also involved Canadians or persons in Canada is incidental. Such monitoring is considered "inadvertent".

Well, OK, accidents do happen. But the data concerning the communications of the Canadians/persons in Canada is immediately deleted, right?

Look again at that slide. Does that information look deleted to you?

In fact, CSE is allowed to retain such communications as long as they are relevent to the "foreign intelligence" being sought.

The identity information of the Canadians involved must be replaced by a stock phrase like "Canadian person" in any reporting involving that communication, but if analysts or their customers believe that your identity is important to understanding the intelligence (and they subsequently hop through the right hoops) it can be retrieved from CSE's databases.

In short, you have the right to privacy as long as they consider your identity to be of no interest to them.

The example on the slide involves metadata. We don't know whether the content of these communications was also examined, but my guess is that at this stage of the "target development" process it was not.

But the point remains the same. The laws pertaining to the interception of communications do not apply to the monitoring of metadata, but the assurances that CSE makes about not targeting Canadians do apply to our metadata.

The reason that CSE can -- and does -- examine the metadata of some communications that involve Canadians is that those absolute-sounding assurances do not mean what they'd like you to think they mean. There is always a secret asterisk attached.

Update 10:50 PM: You can also make out the Canadian communications on this slide (H/T to Canleaks):


Camelot! No longer just a model

The CBC's Greg Weston has put together a nice introduction to CSE's nearly complete new headquarters complex ("Inside Canada's top-secret billion-dollar spy palace," CBC News, 8 October 2013).

There's video as well, but I think the text is probably the most informative part.

A couple of comments:
CSEC officially estimates the complex will cost $880 million. But sources close to the project say it will be closer to $1.2 billion by the time all the associated costs are tallied.
Another source that says that the price tag will be closer to $1.2 billion is the Public Accounts of Canada 2012, which puts the total estimated cost of the project at $1.170 billion (p. 11.17). It is not clear, however, whether this estimate includes the $70 million or so spent on the first building built at the site, the Mid-Term Accommodation Project (now known as Pod 1 of the complex), which was constructed under a separate contract and completed in 2011.
The nerve centre of the agency is a separate concrete bunker the size of a football field, home to what is being touted as the most powerful super-computer in the country, along with its mammoth electrical power generators and cooling systems.
The "bunker", I am guessing, will actually host CSE's data warehouse, which will be the Canadian equivalent of the NSA's Utah Data Center but perhaps one-fifth its size. They're going to be able to store a LOT of data in there.

The supercomputers, I think, are in Pod 1.

In practice, of course, the division may not be quite as clearcut as that. The data warehouse may also be designed to do a lot of processing of the data for CSE, and if that's the case, then it might well qualify as the most powerful computer in the country.

You can see a series of photos of the complex under construction and my accompanying comments here.

I would welcome reader contributions to the further analysis of these buildings and the systems they will host.

Some other interesting tidbits in Weston's report:
When fully operational, the data centre alone will apparently suck up enough electricity to light much of the nation’s capital.

Adams says a lack of electrical and computing power is the main reason the agency is having to move from its current location in south Ottawa, a cluster of buildings dating back to the 1960s, the main one previously occupied by the CBC.

He says the agency’s existing computers could only run at 60 per cent capacity without overloading the local power grid.

CSEC also needs about three times more computing power than it has, plus a full backup, Adams says. “There are more transactions at CSEC on a daily basis than all of our banks combined.”

Wednesday, October 09, 2013

New CSE Commissioner appointed

The Honourable Jean-Pierre Plouffe has been appointed as the new oversight commissioner of the Communications Security Establishment:
"I am pleased to announce Jean-Pierre Plouffe’s appointment as Commissioner of the Communications Security Establishment," said Minister Nicholson. "Mr. Plouffe brings extensive legal knowledge to the position, including experience in the Military Justice system.”

A graduate of the University of Ottawa, Mr. Plouffe was appointed to the Superior Court of Quebec in 1990, and was appointed as a Judge in the Court Martial Appeal Court of Canada in March of 2013.

Mr. Plouffe has had a long and distinguished career, beginning in the office of the Judge Advocate General, where he retired as a Lieutenant-Colonel, then as a defense lawyer for Court Martials while with the private practice of Seguin, Oulette, Plouffe and Associates in Gatineau, QC, as well as for Legal Aid in Hull, Quebec. He was appointed a Military Judge in 1980 as a Reserve officer, and then as a Judge in the Court of Quebec in 1982.
News release here.

Does CSE do economic intelligence?

Some of the recent coverage of CSE has expressed a certain amount of skepticism about the idea that CSE might do economic intelligence-gathering.

For example, Wesley Wark, one of the leading experts on intelligence issues in Canada, expressed considerable doubt about the possibility in this article (Mark Gollom, "Brazil-Canada espionage: Which countries are we spying on?" CBC News, 8 October 2013), suggesting instead that Canada may have pursued its Brazilian targets at the behest of one of its UKUSA partners:
Security and intelligence expert Wesley Wark expressed doubts that any effort to collect information on Brazil was purely a Canadian intelligence operation with Canadian objectives.

Wark also questioned how Canada would be able to get access to those kinds of communications and why CSEC would devote its limited resources against a target not considered a top-tier threat.

"If this was a made in Canada intelligence operation, It doesn’t make a lot of sense to me," said Wark, who is also a professor at the graduate school of public and international affairs at the University of Ottawa.

Instead, Wark said he believed this task was handed down to Canada by one of its so-called "Five Eyes" partners — the U.S., U.K., Australia and New Zealand — who all share intelligence. Most likely, Wark said, it came from America's National Security Agency, which, according to previous revelations by former U.S. National Security Agency contractor Edward Snowden, had been targeting Brazil in the past.

"It would fit in with the modus operandi of the Five Eyes partnership that an intelligence task like this, which would include intelligence collected by one partner, might actually be handed over to another partner for processing and work," he said.

"Very often the intelligence that's gathered is distributed among partners to be worked up and I suspect that's what's happening in this case."

CSEC's legislative mandate when it comes to collecting foreign intelligence is very broadly defined in the National Defence Act, he said.

The secretive organization has played roles in Afghanistan, he said, by supporting military operations there, and also assisted in the hunt for the kidnappers of Canadians Robert Fowler and Louis Guay in Niger.

"We don’t really have any general sense of its strategic effort to collect intelligence," said Wark.

And there's nothing in the act that prevents it from gathering economic intelligence or explicitly states that it would be a natural part of what CSEC does, Wark said.

But he was skeptical about the amount of economic espionage CSEC has conducted in the past.

The agency's primary targets include global terrorist organizations, conflict zones where Canadian interests or Canadian troops are involved and weapons of mass destruction. Economic intelligence has not been a priority, he said.

"I don’t think it does much of it, if any at all."

And if economic intelligence has become a new priority, he said, then the public needs to be aware of it.
While it's indisputable that Counter-Terrorism and Support to Military Operations have been at the top of CSE's priorities list in recent years, I'm not so sure that Economic Intelligence is that low on the list.

Part of the problem here may lie in varying definitions of economic intelligence, which can range from data on future global energy supplies and the functioning of the global economic system to the inside scoop on the negotiating positions of other countries participating in trade negotiations to detection of bribery and bid-rigging in international competitions for multi-billion-dollar contracts to the theft of competitors' trade secrets and provision of that information to companies in one's own country.

There is absolutely no doubt that CSE, working alone and through its allies, collects some of these types of information. The contentious question, to which the public has no solid answer, is how far it goes toward the right-hand end of this spectrum.

But there have certainly been suggestions from time to time that Canadian activities have extended pretty far towards the right-hand side.

In the early 1980s, the use of Canadian SIGINT on global wheat production and pricing to maximize the price at which Canadian wheat could be sold was widely cited in news reporting about CSE (Neil Macdonald, "Security bill: `It leaves few places to hide'," Ottawa Citizen, 10 September 1983):
Of far more importance and value [than security related traffic]... is the commercial and diplomatic traffic intercepted by the CSE. Other government departments, notably External Affairs, "just hunger for it," said one source. The classic example given by security experts is information on the wheat market, Canada's most important area of trade with the Soviet Union. "A Soviet delegation might be over here pretending they don't really need all that much this year, and that they aren't willing to pay as much for it," said one government expert. "In the meantime, CSE has Sigint ...indicating there's been a crop failure in the Ukraine and they're desperate for our wheat. We can save Canadian farmers and grain dealers a fortune, so why not? Everybody does it."
Allies were also reportedly the target of such collection:
[Former Solicitor General Allan] Lawrence noted that the U.S. is one of Canada's major trading rivals: "They (the CSE) gave me the wheat scenario, too. Sure, we should know what effects the crop failure in Russia will have. But we should also know what the Argentines or what the U.S. are going to do about it."
Mike Frost's book Spyworld describes a specific instance of CSE collecting intelligence on U.S. plans for wheat sales to China, although the intercept in that case was said to have been inadvertent (pp. 224-7).

Spyworld also reported that CSE was directed to collect intelligence on an upcoming pipeline contract in India:
In 1985, the "Pilgrim" team got another "special" request from External Affairs for the New Delhi team. At one of their meetings an External representative told Frost: "The Minister would like you to look into some economic intelligence.... We have a Canadian company bidding on a pipeline to be built in India for $2.5 billion, and we'd like to get as much information on what's going on as possible." (p. 193)
Around the same time, in 1984, CSE began embedding Client Relations Officers in customer departments. The first four departments to host CROs were the Privy Council Office, External Affairs, Finance, and Industry, Trade and Commerce. (See more here.) This development was probably related to CSE's decision to begin operating embassy intercept sites and satellite monitoring facilities a few years earlier.

The 1990s brought a much increased emphasis on economic intelligence, if the whistleblowers of the period -- Mike Frost, Jane Shorten, and Fred Stock -- can be believed. All claimed that economic spying was stepped up significantly following the end of the Cold War, as CSE sought to justify its existence in an "end of history" world that was supposed to be characterized from then on by peaceful economic competition.

Wark himself had some interesting comments on the Shorten allegations at the time ("Canada to review agency accused of spying on allies," Associated Press, 14 November 1995):
Wesley Wark, a University of Toronto history professor, said spy agencies around the world, including those of the United States, France and Japan, increasingly gather economic information.

Wark said Canada would be foolish not to join in.

"I don't know what a friendly power in the economic sphere is, exactly, these days," he said. "That seems to be a very ambiguous term."
The government seemed to agree.

How far to the right of the spectrum economic intelligence-gathering routinely went we do not know, but by the 1990s its place in the pantheon of CSE priorities was freely acknowledged by the Canadian government.

Consider this April 1990 statement by Ward Elcock, then Deputy Clerk (Security and Intelligence, and Counsel) in the Privy Council Office, to the Special Committee on the Review of the Canadian Security Intelligence Service Act and the Security Offences Act:
The Communications Security Establishment... has in essence two roles. One of those is sometimes known as the ComSec role, which deals with the security of the communications of the Government of Canada. The second responsibility is the collection of signals intelligence, which is intended to provide the government with foreign intelligence on the diplomatic, military, economic, security and commercial activities, intentions, and capabilities of foreign governments, individuals, and corporations. [Emphasis added]
And the organization of the agency reflected those priorities: the largest of the two analysis groups within CSE's SIGINT Production Directorate was the International Political and Economic Production Group. The Soviet Production Group, previously the largest, had shrunk dramatically with the end of the Cold War, re-emerging as the combined, but still smaller, Military Production and Transcription Group.

Job ads in the late 1990s sought candidates with "a keen interest in global economic and political affairs" and "either a) proficiency in at least one Asian, Middle-Eastern or European language, or b) an academic background or experience in international economics, international business or international finance."

There is no doubt that CSE's intelligence priorities changed once again following 9/11. But the current CSE is more than twice as large as the CSE of the 1990s, and there is no reason to believe that economic intelligence ever disappeared entirely from the organization's remit.

So...

Does CSE collect economic intelligence?

Yes.

Is it stealing trade secrets or subverting bidding processes for the benefit of Canadian companies or industries?

There is some reason to believe such activities have been conducted at least occasionally in the past, but how often they are currently conducted, if at all, remains to be seen.

Let us now all turn, expectantly, in the direction of Glenn Greenwald.

[Update 11 October 2013: Journalist Andrew Mitrovica comments on Jane Shorten:
I have to take issue... with your reference to Jane Shorten. As you may know, I have written about my 1995 reporting about Shorten while I was at CTV earlier this week for the Star and in today's Citizen.

You write that "if the whistleblowers of the period like Mike Frost, Jane Shorten and Fred Stock -- can be believed."

I can't speak for Frost or Stock because I haven't tested the veracity of their statements to other journalists. I did, however, spend some considerable time with Shorten before, during, and after her extensive interviews with me and a former CTV colleague.

Shorten told the truth, no if, cans or buts. You do her a disservice by implying that there remains doubt about what she so courageously shared with Canadians about what she was no longer prepared to tolerate doing on CSEC's behalf in the name of "national security."

She went public with her grave concerns at great personal risk. She did not make a cent or profit in any other way by stepping forward to tell Canadians the truth. All she wanted was a mechanism to be established to rein in what she believed to be CSEC's unchecked powers.

And to her credit, that is precisely what happened. The Liberal government of the day created the office of the CSEC commissioner - limp as it is - in direct response to Shorten's iron-clad revelations. She did it. Not journalists, academics or bloggers.

So I think you need to correct the record and recognize the invaluable and indisputable role Shorten played in raising the alarm and forcing the government's historically reluctant hand in creating the one and only oversight body over CSEC.
(Reproduced with permission. Thanks, Andrew!)]

[Update 13 October 2013: I personally have no doubt that Jane Shorten was telling the truth. And I would agree that her revelations probably did a lot to ensure the creation of the Office of the CSE Commissioner.

But the Chretien government had already agreed in principle to establish such a mechanism by the time Shorten spoke up. On March 21st, 1995, the House of Commons passed a motion introduced by Liberal MP Derek Lee calling on the government to "establish an independent external mechanism to review the operations of the Communications Security Establishment, CSE, similar to the role played by the Security Intelligence Review Committee for the Canadian Security Intelligence Service, and table a report annually in the House." The Liberals had a comfortable majority in the Commons at the time, and this motion could only have passed with the de facto support of the Chretien government. The day after the motion, Defence Minister David Collenette announced that "in principle, the government supports an oversight mechanism for the CSE".

Derek Lee's motion was the result of a lot of prior work of many MPs, academics, and others, and it was passed in the context of extensive recent CSE-related reporting, most notably of Mike Frost's revelations in Spyworld, which was published in October 1994.

Did Shorten's revelations in November 1995 help ensure that the government's stated support for an oversight mechanism was followed up by the actual creation of the Office of the CSE Commissioner in June 1996?

I think that's quite likely.

We can certainly dismiss any role of bloggers in the events of 1995 and 1996.

But let's not ignore the contributions of the many other concerned Canadians whose efforts helped create the CSE oversight office.]