New photo of CSEC's new headquarters

Here's the latest aerial photo of CSEC's new headquarters complex.



The large, windowless, rectangular building towards the left of the image is CSEC's data warehouse.

CSEC has described its new headquarters complex as the "largest repository of Top Secret information in Canada", and the data warehouse, Canada's version of the Utah Data Centre, is where that information will reside. [Update 2 January 2014: CSEC has also described itself as holder of "the largest volume databases in the country".]

Five twin-cell cooling towers can be seen on the ground on the west (near) side of the warehouse. The cooling towers are used to remove the waste heat generated by the massive computer arrays in the building.

Even during the winter, cooling is required. The temperature in Ottawa was around -5 degrees celsius on the day the photograph was taken, but one of the twin-cell towers can be seen in operation. This confirms that the data warehouse is now operational. (It probably became operational sometime in the past year.)

CSEC also has a high-performance computing centre at the site (the two-level rectangular building extending towards the viewer from the curved glass wall of the main building). This building, known as Pod 1, houses the most powerful supercomputers in Canada, which are used for cryptanalysis and computationally intensive data mining. A cooling tower can be seen operating on the roof of Pod 1 as well.

Earlier photos of the site can be seen here and here.

(H/T to Chuck Clark.)

Freeze on "CSEC 101"

Colin Freeze reports on "CSEC 101: Foundational Learning Curriculum", the introductory lecture series that is presented to all new CSEC employees, which the Globe and Mail obtained in redacted form through the Access to Information Act:

Colin Freeze, "CSEC sends strong message of privacy to new recruits," Globe and Mail, 22 December 2013.

The article contains lots of interesting background on life in Canada's SIGINT agency, including an introduction to the "most famous SIGINTer" of all, the "Traffic Fairy".

Update 25 December 2013:

Freeze's discussion of the document and posts of selected images on Twitter collected here. BZ to Koen Rouwhorst!

Update 31 December 2013:

The full, redacted document is now available here.

What your online activity could tell the government

Infographic produced by OpenMedia.ca (click on graphic to see the full version).

U.S. metadata ruling: Consequences for Canada?

CSEC and CSIS were not the only spy agencies to face a "thundering rebuke" in the courts recently. The U.S. National Security Agency also had a very bad week (news article; judicial ruling).

This Global News report asks whether U.S. developments will have any effect on the B.C. Civil Liberties Association's lawsuit (see also here), launched in October, concerning CSEC's use of Canadian communications and metadata (Nick Logan, "NSA rulings could help Canadian group argue case against CSEC," Global News, 20 December 2013):

Two rulings on U.S. surveillance activities this week could be useful for a Canadian group seeking limits on domestic intelligence gathering.

“We’re pleased that there is a process ongoing, at least in the United States, to create a balance between the protection of national security and the protection of privacy and free expression in the U.S.,” said Caily DiPuma, counsel for the B.C. Civil Liberties Association (BCCLA).

BCCLA launched a lawsuit in October to challenge “the collection of Canadians’ private communications and metadata — which includes phone numbers, length of phone calls, email and IP addresses — by the Communications Security Establishment (CSEC).

U.S. District Court Judge Richard Leon ruled on Monday the National Security Agency’s (NSA) telephony metadata gathering program was likely unconstitutional and he granted a preliminary injunction against the further collection of phone records. ...

“Judge Leon’s decision found a right of privacy in telephone metadata and that ruling is essential to a proper finding in our case. So of course we would refer the court to his reasoning there,” [DiPuma] said. “Obviously the Canadian court would not be bound by it, but it would certainly add some sort of persuasive value to our argument.”

Like the U.S. lawsuit, the BCCLA case was born out of the release of classified documents, leaked by former intelligence contractor Edward Snowden, that revealed secret programs the U.S. and its partners used to monitor telecommunications.

The report also quotes former CSEC Chief John Adams, who reiterates his support for creation of a parliamentary review committee. (Note, however, that Adams was Chief of CSEC from 2005 to 2012, not 2005 to 2007.)

End product meets fan: Justice Mosley's Further Reasons for Order

The redacted version of Justice Richard Mosley's 22 November 2013 Further Reasons for Order has now been released (Ian Macleod, "CSIS asked foreign agencies to spy on Canadians, kept court in dark, judge says," Ottawa Citizen, 20 December 2013):

Canada’s foremost jurist on national security law has slammed CSIS for deliberately keeping the Federal Court of Canada “in the dark” about outsourcing its spying on Canadians abroad to foreign agencies, according to a redacted version of a classified court decision made public Friday.

In a thundering rebuke, Federal Court Judge Richard Mosley said the Canadian Security Intelligence Service (CSIS) purposely misled him when he granted it numerous warrants beginning in 2009 to intercept the electronic communications of unidentified Canadians abroad suspected as domestic security threats.

“This was a breach of the duty of candour owed by the service and their legal advisers to the court,” Mosley said in his Further Reasons for Order.

CSIS also mistakenly assigned powers to the warrants that the court never authorized and which do not exist in law, he said.

“It is clear that the exercise of the court’s warrant issuing authority has been used as protective cover for activities that it has not authorized,” Mosley wrote.

Furthermore, tasking foreign security intelligence services to spy on Canadians overseas “carries the risk of the detention of or other harm to a Canadian person based on that information.

“Given the unfortunate history of information sharing with foreign agencies over the past decade and the reviews conducted by several royal commissions, there can be no question that the Canadian agencies are aware of those hazards. It appears to me that they are using the warrants as authorization to assume those risks.”

...

At the time the first warrants were issued, CSIS told the court “on clearly stated grounds” that the electronic intercepts would be carried out from within Canada by the Communications Security Establishment Canada (CSEC), the country’s foreign signals intelligence spy service.

CSIS is largely restricted to domestic spying operations. If an investigation involves the use of intrusive techniques, such as electronic intercepts, Section 21 of the CSIS Act requires it to obtain a warrant approved by a Federal Court judge to guard the Charter right to a reasonable expectation of privacy.

CSEC, meanwhile, is not allowed to spy on Canadians anywhere unless it is to provide technical and operational assistance to federal law enforcement and security agencies such as CSIS.

And the federal court only has jurisdiction to authorize warrants under the CSIS Act as long as the communications in question are intercepted within Canada.

CSIS successfully argued before Mosley that by limiting execution of the interception techniques to passive listening posts on Canadian soil, the arrangement would be within the power of the court to authorize. It also would respect the territorial sovereignty of the country or countries in which the terrorist targets were staying. No reference was made to tasking allied foreign agencies.

Yet once the so-called 30-08 warrants were approved by the court, CSEC, on behalf of CSIS, turned around and handed the jobs to one or more of its partners in the “Five Eyes” intelligence-gathering alliance between Canada, the United States, Great Britain, Australia and New Zealand.

Macleod's article also reports CSEC's response:

We will be reviewing this decision carefully. CSE may only conduct intelligence activities in Canada under its mandate to provide assistance to federal law enforcement and security agencies upon request. These activities respect Canadian laws and Canadian values, and are conducted under the requesting agency’s legal authorities, such as any applicable court warrant. CSE is bound by and must respect any limits in those authorities. All CSE activities are subject to review by the CSE commissioner, who for 16 years has reported that CSEC continues to act lawfully in the conduct of its current activities.

Yeah, well, maybe not for much longer.

And this isn't the first questionable moment in those 16 years.

More coverage:

- Colin Freeze, "Canada’s spy agencies chastised for duping courts," Globe and Mail, 20 December 2013
- Colin Perkel, "Judge slams Canadian spies for misleading court, withholding information," Canadian Press, 20 December 2013

Background here and here.

Update 27 October 2014: Amendments to the CSIS Act introduced in parliament today should enable CSIS and CSEC to resume monitoring Canadians abroad.

CANSLO/C-W established in 2009

CSEC documents (H/T to Colin Freeze) show that CSEC and its Australian counterpart, the Australian Signals Directorate, began stationing liaison officers at each other's headquarters in 2009.

The Canadian liaison office, known as the Canadian Special Liaison Office Canberra-Wellington (CANSLO/C-W), is located at the ASD's heaquarters in Canberra. The CANSLO/C-W is also accredited to New Zealand's SIGINT agency, the Government Communications Security Bureau (GCSB), located in Wellington, New Zealand (which explains why Wellington is in the title). Australia's liaison office in Ottawa is known simply as the Australian Liaison Office (AUSLO). GCSB's liaison office at the NSA appears to handle Canadian liaison for New Zealand's agency.

Canada has maintained liaison officers in the U.K. (CANSLO/L) since 1949 and in the U.S. (CANSLO/W) since 1950 (although the U.S. arrangement wasn't formalized until 1954) (see the partial list of CANSLOs here). But it took almost 60 more years for Canada to send a liaison officer to Australia.

What changed to convince CSEC to open an office in the Antipodes?

Most probably, it was the economic rise of the Asia/Pacific region, and in particular the rise of China.

These days, the UKUSA agencies do not have the world as neatly divided into geographic areas of specialization as they are said to done back in the Cold War days. But each agency does direct special attention to areas of particular interest to its national government, and in Australia's case, that includes neighbours, near-neighbours, and important regional actors such as Indonesia, India, Japan, and China.

As Canada's intelligence sights have turned towards the Asia-Pacific region in recent years, it is likely therefore that CSEC has had increased reason to work closely with and to draw upon the skills and experience of ASD.

Why 2009?

The reasons for the upgrade in the CSEC-ASD relationship have not been made public, but it may be significant that Canada began a concerted effort to improve relations with China and to expand Canada-China trade in 2007/2008.

In their first few years in office the Harper government seemed often to go out of its way to antagonize China's leaders. But in 2007 the government identified "extending our reach to new markets, starting with Asia," as one of the three core elements of its new Global Commerce Strategy. Lecturing the Communists was out. The July 2008 meeting between Chinese President Hu Jintao and Prime Minister Harper on the sidelines of the G8 summit in Japan marked a turning point in the Harper government's relations with China, and 2009 saw visits to China by Trade Minister Stockwell Day, Foreign Minister Lawrence Cannon, Transport Minister John Baird, Finance Minister Jim Flaherty, and ultimately the Prime Minister himself, and the opening of new Trade Commissioner Service offices in Chengdu, Nanjing, Qingdao, Shenyang, Shenzhen, and Wuhan.

It seems likely that the government's demand for intelligence on China, both political and economic, increased significantly around the time these developments occurred.

Unfortunately, as a report written in February 2009 by former Canadian diplomat and China expert Charles Burton noted, the Canadian government was woefully short on expertise on China at this time:

The effectiveness of the divisions of DFAIT, CSIS and DND responsible for Canada’s relations with China is severely inhibited due to allocation of personnel without China-specific expertise to positions that demand this expertise.

(Burton did note, however, that while DFAIT, CSIS, and DND were severely lacking in people with linguistic and cultural expertise, "there is stronger Chinese language ability among the relevant personnel in the Communications Security Establishment Canada and in the International Assessment Staff of the Privy Council Office.")

Among other recommendations, Burton suggested that

Reporting on China by DFAIT and the Intelligence Assessment Staff of the Privy Council Office as well as the Communications Security Establishment Canada and the Canadian Security and Intelligence Service should be refocused away from general assessments of Chinese affairs and should instead focus reporting on practical matters directly related to Canada’s interests. The relevance to Canada and quality of these reports should be subject to periodic external review to ensure that they are fulfilling the strategic mandate of these agencies.

Translated from the bureaucratese, this would appear to be a gentle suggestion that the Canadian intelligence community was not at that point contributing much of specific relevance to the Canadian government's objectives in China.

Assuming Burton's assessment was accurate (and he appears to have been working with inside knowledge), it may well explain why CSEC sought to build a closer relationship with ASD in 2009.

Update 3 January 2014: The CSEC documents revealing the existence of the CANSLO/C-W can be read here (see page 452). The documents were obtained by reporter Colin Freeze under the Access to Information Act and have now been posted online by him. See also Freeze's article in the Globe and Mail (Colin Freeze, "CSEC sends strong message of privacy to new recruits," Globe and Mail, 22 December 2013).

Economic intelligence gathering IV

Does CSEC do economic intelligence gathering? (Previous comments on this question here, here, here, and here.)

This statement found in Section IV of the Department of National Defence's 2011-2012 Report on Plans and Priorities pretty much spells it out in black and white:

In line with the priorities approved annually by the Cabinet’s Ad Hoc Committee on Security and Intelligence, CSEC will continue to provide intelligence to hundreds of clients across the federal government to help them better understand global issues and inform their decisions. These priorities include:

• terrorism and extremism;
  
• mission in Afghanistan;
  
• proliferation of weapons of mass destruction;
  
• cyber security;
  
• foreign espionage and interference;
  
• Canada’s Northern Strategy; and
  
• international security and prosperity interests.

Prosperity interests.

As I noted earlier, economic intelligence gathering does not necessarily mean stealing foreign companies' secrets for the benefit of Canadian companies: such intelligence could also include data on future global energy supplies and the functioning of the global economic system, inside information on the negotiating positions of other countries participating in trade negotiations, and the detection of bribery and bid-rigging in international competitions for multi-billion-dollar contracts. It could mean listening in on the internal deliberations of foreign (non-Five Eyes) delegations participating in G8 and G20 summits.

But it might also -- on some occasions -- mean helping Canadian companies by supplying inside information on competitors' plans, operations, technologies, or bids.

The latter role might explain the fact that CSEC had a "Business Support Unit" within its SIGINT branch during the mid-2000s.

Does this unit or something equivalent still exist? It seems likely.

"Prosperity" may be the last item on the 2011-12 list of priorities quoted above, but it is near the top of the Harper government's foreign policy priorities. In November, International Trade Minister Ed Fast announced that the government would increase the support it provides to Canadian companies seeking export contracts: "We must be more aggressive and effective than the intense competition we face as we advance Canada’s commercial interests in key global markets. This new plan represents a sea change in the way Canada’s diplomatic assets are deployed around the world, and in so doing, we are ensuring that the commercial success of Canadian firms and investors is entrenched as one of our core foreign policy objectives.”

Want to see the CSEC priorities list for yourself? Sadly, you're out of luck. The "Section IV" material in DND's Reports on Plans and Priorities (RPPs) is not contained within the actual RPP documents. Instead, the documents contain a link to the DND website, where the material is posted separately. The RPPs from earlier years remain available on the web, but the Section IV material is scrubbed from the DND website after a year or two. The 2011-12 discussion of CSEC, its funding levels, and its priorities has thus evaporated.

And there will be no more such discussions. When CSEC became a stand-alone agency in November 2011, it stopped appearing in the National Defence RPPs.

It doesn't publish its own Report on Plans and Priorities. (Or Departmental Performance Report. Or Annual Report.)

CSEC's description in the Main Estimates document is the only remaining place where annual reporting of the agency's plans and priorities might be published. But in fact the description in the Main Estimates is nothing more than a couple of sentences of boilerplate that provide no new information.

What changed between June 2011, when the detailed description quoted above was published, and November 2011 that would justify that precipitous drop in public accountability? Neither CSEC nor its minister have even pretended to provide an answer. Nor, as far as I can tell, has a single member of parliament even raised the issue.

November 2013 CSE staff size

2138, a new record.

Up 14 from last month's 2124, which was also a record.

(If you click through on the link and get a different figure, it's probably because the Canada Public Service Agency has updated its website; they update the numbers once a month.)

Baud on improving intelligence review

Worth reading:

Patrick Baud, "Intelligence oversight: stumbling around in the dark," iPolitics, 13 December 2013.

See also Patrick Baud, "Calling For More Eyes On Our Cyber Spies," OpenCanada.org, 22 October 2013.

The Camelot song, CSEC version

Posted on the Creekside blog back in October, Monty Python's "Camelot" song with updated lyrics:

We're Knights of the CSEC Table
We hack whene'er we're able
We snoop emails and "Search" details
On fibre optic cable.
We dine well here in Camelot
Coz a billion bucks buys quite a lot.

We're Knights of the CSEC Table
Our building's formidable,
Catching Pierre Poutine is not our scene
That case is unbreakable.
Brazil is mad at Camelot
Coz we sing to NSA a lot.

As spooks we're tough and able
Quite indefatigable.
But Greenwald's leaks on our techniques
Have made things quite unstable.
It's a busy life in Camelot
Appeasing Uncle Sam a lot.

For those who missed it, CSEC called the construction of its new headquarters Project Camelot.

Beats Bumblehive.

CSE Commissioners: How effective?

CBC reporter Greg Weston raises questions about the effectiveness of CSEC's watchdog, the CSE Commissioner ("CSEC watchdog muzzled, defanged: Greg Weston," CBC News, 13 December 2013):

The revelation that a little-known Canadian intelligence operation has been electronically spying on trading partners and other nations around the world, at the request of the U.S. National Security Agency, has critics wondering who's keeping an eye on our spies.

The answer is a watchdog, mostly muzzled and defanged, whose reports to Parliament are first censored by the intelligence agency he is watching, then cleared by the minister politically responsible for any problems in the first place.

By the time the reports reach the public, they are rarely newsworthy.

The Harper government recently appointed a new oversight commissioner for Canada's electronic spy agency, the Communications Security Establishment Canada. But he will be only part-time until next April.

Even then, Senator Hugh Segal, the chief of staff to former Conservative prime minister Brian Mulroney and someone with a long involvement in security intelligence issues, says any notion of effective public oversight of Canada's electronic spying agency is "more like a prayer" than fact.

Weston addresses some important concerns in this report.

I think his account of some of the legal compliance issues that have been raised by Commissioners over the years is somewhat garbled, but CSE Commissioner reports are written in such deliberately obscurantist language that it's hard to be sure, and I won't even pretend that I have it all figured out myself.

That said, some important legal issues have definitely arisen during the Commissioners' work.

The most headline-worthy example was of course the statement in the Commissioner's most recent report that "a small number of records suggested the possibility that some [CSEC] activities may have been directed at Canadians, contrary to law. A number of CSEC records relating to these activities were unclear or incomplete. After in-depth and lengthy review, I was unable to reach a definitive conclusion about compliance or non-compliance with the law."

The activities in question reportedly took place in the early 2000s, and no actual finding of illegality was made, but the Commissioner's statement was hardly a clean bill of health.

In some ways even more disturbing is the longstanding dispute between Commissioners and the government over the nature of the ministerial authorizations used to enable CSEC to collect communications that may sometimes involve Canadians. It is unclear when Commissioners first raised this issue, but it has been going on for at least a decade.

The Commissioner's 2009-10 report stated that "Commissioner Gonthier was informed by the Minister of National Defence that clarification of ambiguities and other amendments to the [National Defence Act] are a legislative priority. Pending amendments, Commissioners have continued to use the interim solution of applying a qualified opinion, that is, reviewing CSEC foreign intelligence collection activities under ministerial authorization on the basis of the NDA as it is interpreted by Justice Canada. However, past Commissioners have noted they disagree in certain important respects with that interpretation, which highlights the need for amendments to the NDA."

Unfortunately, the Harper government has done nothing to address this "legislative priority" in the years since that report. In the Commissioner's most recent report, retiring Commissioner Robert Décary lamented that "I started my mandate with the expectation that the legislative amendments to the National Defence Act proposed by my predecessors would soon be introduced in Parliament, but this has yet to happen. I am deeply disappointed at the lack of action by the government, which is no longer in a minority situation, to address the ambiguities identified by my predecessors and myself. These amendments — as I have said many times before — would improve the provisions that were hastily enacted in the aftermath of September 11, 2001. The proposals to address the issues raised by Commissioners should not, in my opinion, be controversial."

As Décary's predecessor Charles Gonthier stated in his 2008-09 report, "the length of time that has passed without producing amended legislation puts at risk the integrity of the review process.”

How can Canadians have confidence in the effectiveness of a watchdog whose fundamental job is to assess compliance with the law when those assessments can be postponed essentially forever through the simple expedient of government inaction?

Another concern arises from the fact that the Commissioner doesn't seem to make an ultimate declaration of lawfulness in all cases.

In 2006 the CSE Commissioner began expressing the view behind closed doors that certain CSEC metadata activities that the agency argued were authorized under part (a) of its mandate should properly be considered mandate (c) operations. As Gonthier argued in a letter to the Minister of National Defence, "This is important because it determines the legal requirement (e.g. ministerial authorization vs. a court warrant) in cases where activities may be 'directed at' a Canadian; it also determines which agency is responsible for the information and how the information collected should be handled."

In 2008 CSEC made what the Commissioner considered to be "significant changes" in its practices concerning these activities, and in 2011, following a review of CSEC's new practices, his successor reported that he had "no questions like those raised in previous reviews as to whether such activities would be more appropriately authorized under part (c) of CSEC’s mandate."

The fact that CSEC changed its practices in this case in response to concerns expressed by the CSE Commissioner is laudable, but it doesn't change the fact that those earlier practices existed.

Where is the Commissioner's final judgement on the lawfulness of those practices? Certifying to the public that CSEC acts within the law is the CSE Commissioner's fundamental role, yet as far as we in the public can tell, this question was simply dropped.

It's little wonder that the Defence Minister and other CSEC spokespersons can claim, as they love to do, that in 16 years of reports, CSEC has never been found to have acted unlawfully, if CSE Commissioners are willing to wait for 10 years or more without making an official judgement, will drop questions of lawfulness without ever making a judgement if the behaviour in question is later changed, and, in at least one case, have been unable to make a judgement because of the absence of adequate records.

Why, however, such a claim should be considered a meaningful reassurance under such circumstances is another question.

Call to protect Canadian data in the U.S.

Worth reading (Lisa M. Austin, Heather Black, Michael Geist, Avner Levin & Ian Kerr, "Our data, our laws," National Post, 12 December 2013):

[Bill C-551] is a welcome move towards providing greater transparency and accountability for Canadian intelligence agencies, yet attention to oversight is not enough. We also need to address the legal framework under which these agencies operate, and the privacy protections granted to Canadians under the law.

This is true not only for Canada — our law’s 20th-century privacy protections are no match for 21st-century surveillance technologies — but also for U.S. law. The need for U.S. reforms may represent an enormous challenge, but Canadians find themselves between a proverbial rock and a hard place, as our communications data is increasingly stored on the servers of U.S. companies subject to U.S. law.

U.S. cloud computing services and apps such as Gmail, Dropbox and Evernote are very popular with both individual users and large organizations. Indeed, several Canadian universities have already, or are currently considering, outsourcing their email to cloud-based services offered by U.S. giants such as Google and Microsoft. This means that hundreds of thousands of Canadian teachers and students will find their personal data hosted in the United States, with little or no say in the matter.

The move to the cloud certainly offers some convenience and cost savings, yet it also makes our data vulnerable to state surveillance through NSA programs such as PRISM and MUSCULAR. As renowned security expert Bruce Schneier recently wrote, the NSA did not build an Internet surveillance system alone; it noticed that Internet companies had already done this “and simply got copies for itself.”

...

We are not opposed to cloud computing in principle. Some of us have been enthusiastic users of U.S.-based cloud computing such that we cannot remember what it was like to work without Dropbox and other services. Some of us have been supporters of outsourcing and have even made, or helped to make, key legal decisions in this area.

Global communications presents so many opportunities and we need to embrace it rather than lock down our borders. But just as we would not shop online without legal assurances that our financial information is kept secure, we should not be willing to place our data in the U.S. cloud without stronger privacy protection. This is not about placing barricades around our communications, but about insisting on the basic conditions for freedom of speech and association.

When we decided to open our border to trade with the United States, we did so with a free trade agreement. That agreement put in place various legal obligations and a dispute-resolution process. This is how we deal with our interconnected world. If we can do it with goods and services, we can do it with data. Our government and our privacy commissioners need to lead the charge by demanding that information about Canadians in the U.S. receive the level of protection afforded to it by our own constitution.

Kline on reining in the Surveillance State

National Post writer Jesse Kline calls for greater transparency and public control over the Surveillance State ("The spy who read my email," National Post, 12 December 2013):

There’s no question that we’re doing a lot more spying than ever before. What Canadians don’t know is whether the $1-billion-plus price tag for our spy agencies is money well spent. Are these agencies keeping us safe, or have we built up a top-secret surveillance apparatus that has nothing better to do than spy on our allies and collect personal information on everyone who uses the Internet? Without a greater degree of transparency, the citizens of this democracy are unable to have an informed debate about what types of activities these agencies should be involved in. ...

The level of detail governments can obtain about the lives of ordinary people is unprecedented in human history. Where the Internet was once seen as the great liberator — a place where anyone could speak their minds, free from the control of autocratic governments and mass-media gatekeepers — it now has the potential to become, in the words of journalist Glenn Greenwald, “the most effective means of human control and oppression ever known.”

That is what the Snowden leaks have exposed — a massive government operation to archive and analyze all the world’s communications. Opposing the surveillance state, and demanding the right as free citizens to know what our government is doing, is not a left- or a right-wing issue; it is one of tyranny versus liberty; it’s about whether we want to live in a communist-style surveillance state, or enjoy the rights and privileges of a free society.

Kline also notes the recent allegations that CSEC spying on the G8/G20 summits in Canada may have been illegal:

So what to make of the report that CSEC worked with the NSA to conduct surveillance operations during the G8 summit in Huntsville, Ont., and the G20 in Toronto? Much of the document obtained, and subsequently released, by the CBC, details how the American intelligence operation intended to protect against potential threats. This is what we should expect spy agencies to do at large international events that host the U.S. President, the Canadian Prime Minister and other foreign leaders.

The more worrying passages discuss how NSA support could be used to “further U.S. policy goals” — i.e., spy on other countries to gain a leg-up in negotiations — and work “closely” with its “Canadian partner.” The latter is troubling because it may, in fact, be illegal.

“If CSEC tasked NSA to conduct spying activities on Canadians within Canada that CSEC itself was not authorized to take, then I am comfortable saying that would be an unlawful undertaking by CSEC,” University of Ottawa security expert Craig Forcese told the CBC. Even CSEC Chief John Forster and Defence Minister Rob Nicholson confirmed the agency is not allowed to spy on Canadian soil, or to ask foreign spy agencies to do so.

It's hard not to conclude that if CSEC and NSA did spy on the G8/G20 summit, they must have done so illegally. But in fact such a conclusion would almost certainly be incorrect.

Why? Ironically, it's because you can't trust anything that Forster, Nicholson, and their ilk appear to say. Virtually everything they tell us comes with a secret asterisk attached.

Yes, it's illegal for CSEC to spy on Canadian soil — except under those circumstances when it's legal for it to do so. Such as when CSIS has obtained a warrant to do so under s.16 of the CSIS Act and brings CSEC in under paragraph 273.64(1)(c) of the National Defence Act. Forcese's comment seems pretty damning at first glance, but it applies only to those circumstances where CSEC itself is not authorized to act. It is discussed in that wider context here.

Bottom line on the G8/G20 spying question: Don't trust what the government tells you — they almost certainly were acting legally.

Canadian authors join colleagues worldwide to condemn mass surveillance

More than 550 authors from around the world, including at least 8 Canadians, have signed an international petition condemning mass surveillance (Kim Nursall, "Canadian authors join worldwide condemnation of mass surveillance," Toronto Star, 10 December 2013):

Some of Canada’s most recognizable authors, including Margaret Atwood, Yann Martel and John Ralston Saul, have joined more than 550 writers from around the world to condemn mass surveillance by governments and corporations, the extent of which, in light of snowballing revelations, reads like a work of fiction.

“With a few clicks of the mouse the state can access your mobile device, your email, your social networking and Internet searches,” reads the online petition — “A stand for democracy in the digital age” — which includes signatories from more than 80 countries and five Nobel Prize laureates.

In addition to calling on governments to stop treating everyone “as a potential suspect,” the writers urge the United Nations to create an international bill of digital rights for states to sign and obey.

Although the petition does not name a specific country or program, its demands appear closely tied to the avalanche of state spying operations identified after a massive document leak by former intelligence contractor Edward Snowden.

Covert collection: Whose priorities?

The NSA document that was the subject of Monday's CBC news report stated, among other points, that CSEC "has opened covert sites at the request of NSA" (Greg Weston, Glenn Greenwald & Ryan Gallagher, "Snowden document shows Canada set up spy posts for NSA," CBC News, 9 December 2013; redacted document available here).

Our embassy in Beijing may well be an example of such a site.

In itself, this news should not be very surprising. It is axiomatic within the Canadian intelligence community that Canada receives far more intelligence through the UKUSA alliance than it provides to those allies, so, other things being equal, when an opportunity arises to prove useful to those countries, especially the U.S., the Canadian government is likely to leap at the chance. ("Other things" aren't always equal, of course: the proposed operation may place wider Canadian interests or Canadian personnel at risk, or it may support U.S. policy priorities at odds with those of Canada. The CBC report mentions some of these risks.)

But Canadian officials have been adamant in their public testimony that Canada only collects intelligence corresponding to Canada's national intelligence priorities. We do not collect stuff for allies simply because that's the kind of thing they want.

Consider, for example, this exchange between CSEC Chief Keith Coulter and Senator Serge Joyal in 2005 (Proceedings of the Special Senate Committee on the Anti-terrorism Act, 11 April 2005):

Senator Joyal: Suppose you receive a request from one of those other four countries that does not meet the test of one of those essential elements of foreign affairs? What is the procedure then? How do you deal with it? Do you simply refuse it, do you have to seek authorization or can you, under the agreement, move ahead because it was requested by one of your partners and you are bound by it?

Mr. Coulter: Two things: One is with respect to our allies asking us to do something. I cannot do it if it is not consistent with Government of Canada priorities. On a reciprocal basis, we have that kind of relationship where they can ask us for something in our priorities and we can ask them for something in our priorities, and if it is consistent with theirs, they will do it. We get a lot more from this partnership than we ever give and that is a large aspect of being effective these days, partnering with others. We only do what is consistent with our priorities. ...

Senator Joyal: You have said if it meets the essential priorities, the answer would be yes, you would look into it. If it does not, has it happened that you went to get that authorization from cabinet or from your minister?

Mr. Coulter: No, we would not get to it. This is done by allies on a best efforts basis and without making a big deal out of it. We would not be able to fulfill a request because our legislation says we have to follow Government of Canada priorities.

Or this exchange between the subsequent CSEC Chief, John Adams, and Senator Colin Kenny in 2007 (Proceedings of the Standing Senate Committee on National Security and Defence, 30 April 2007):

Mr. Adams: In relative terms, we are small, obviously, compared to the National Security Agency of the United States. We are relatively small even in comparison to Government Communications Headquarters, GCHQ, in Great Britain. We would generally gain more than we give. There are some areas where we are more active than they are, and that is the game based on our national priorities. There are some areas in the world where we are present and other people are not. Obviously, in that case, we would be an exporter of information, if that information was needed elsewhere.

In total, that is basically it, senator.

The Chairman: Do protocols exist where you have divided up the spectrum, as it were?

Mr. Adams: No, they do not, senator. It is based purely on our priorities as defined by the government.

The Chairman: Allied countries do not get together and say, "You seem to be doing fairly well in this area, but we have a bit of a gap over here; any chance of you moving into it?"

Mr. Adams: No, we do not. If it is important to Canada, we will be there, if we can get there, obviously.

In discussions, as I said earlier, knowing the priorities that we have, we would share if there are mutual priorities and mutual national interests.

Similarly, in a CBC story yesterday (Greg Weston, "Canada’s electronic spy agency says tracking allies is necessary," CBC News, 10 December 2013), CSEC is reported to have stated that "its activities respond only to the priorities of the Canadian government, 'many of which are common to our allies.'"

Now, maybe there is no contradiction between these various CSEC statements and what's said in the NSA document.

It may be that on each of the evidently multiple occasions when NSA has asked CSEC to open a new covert site and received a positive reply, CSEC discovered that the location in question already fit within Canada's intelligence collection priorities.

But I doubt that's the way it went down.

More likely the NSA made its request and the Canadian government then made an assessment of the risks and opportunities posed by the proposal before deciding whether or not to give it the go ahead. And the argument that doing this favour for the NSA would help to reaffirm for the U.S. the value of Canada's participation in the UKUSA alliance would undoubtedly have been highly prominent in any such assessment. Far more prominent, I suspect, than the question of how much interest Canada had in the specific material that might be collected.

Many people would probably consider a favourable decision under such circumstances to be entirely justifiable.

But this is not the process that CSEC just described to the CBC, and it's not the process that our CSEC chiefs spelled out in their testimony before the Senate.

Which brings me back to a question I seem to ask a lot around here: Are these people incapable of speaking the simple truth?

Always with the asterisks.

Misinformation worries CSE Commissioner

The new CSE Commissioner, Jean-Pierre Plouffe, has expressed concern about "misinformation" spreading about CSEC and its partners (Jim Bronskill, "Leaks on Five Eyes spy network are fuelling ‘misinformation,’ CSEC chief says," Canadian Press, 9 December 2013 [I wonder how he feels about being called the Chief of CSEC]):

The watchdog over the national eavesdropping agency says many recent leaks about the Five Eyes intelligence network are being taken out of context by the media.

Jean-Pierre Plouffe, who keeps an eye on Communications Security Establishment Canada, says the leaked tidbits often then become misinformation.

Plouffe told senators on the national security and defence committee that he aims to clarify such information so that it is no longer promoted as myth.

...

“The information provided by Mr. Snowden made the news, often very sensational in the media,” he told senators.

“Unfortunately, this information is often taken out of context, which as a result becomes misinformation. So one of the key objectives of my office is to help to clarify this information and to correct it if necessary so that it is no longer propagated as a myth.”

Update 12:30 pm 10 December 2013: The Globe and Mail has corrected the headline they initially put on the article: "CSEC Chief" now reads "CSEC watchdog".

Update 11 December 2013: The National Post has some additional information on the testimony at the Senate committee hearing: Stewart Bell, "Review underway into allegations that national intelligence agency illegally spied on Canadians," National Post, 9 December 2013.

The Chair of the Security Intelligence Review Committee, Chuck Strahl, also testified at the hearing. According to Bell, "Both Mr. Strahl and Mr. Plouffe urged a cautious approach to Parliamentary oversight of Canadian intelligence services. Mr. Plouffe noted that in the United States, select elected members of the government had access to secret intelligence but that had not stopped the apparent excesses of its agencies. 'It’s never going to be a silver bullet,' he said."

CBC news redacts all the news

CBC News has acquired a new document from the Snowden collection that apparently spells out some of the details of the NSA-CSEC relationship (Greg Weston, Glenn Greenwald & Ryan Gallagher, "Snowden document shows Canada set up spy posts for NSA," CBC News, 9 December 2013). But don't expect to get the news from the CBC.

The only thing that Weston et al. are willing to tell us that wasn't already well known to everyone who cares to follow these issues is the number of countries ("approximately 20") where Canada has clandestine SIGINT collection facilities. [Actually, it's unclear what the "approximately 20" refers to: see below.]

Well, OK, I find that interesting.

But hardly surprising.

The rest of the news story is just a rehash of well-known information such as the fact that CSEC and NSA have cooperated for decades and that the two agencies exchange liaison officers.

There's nothing inherently wrong with rehashing that kind of information -- it will certainly be new for a lot of people -- but please don't try to spin it as the stuff of headlines.

And as for waving a top-secret document around and informing us that you can't tell us what's in it because it's top secret, that's the Minister of National Defence's line.

If there's something in the document that the public ought to know, tell us.

All you're doing now is using it as a prop.

Update 2:00 pm 10 December 2013: Also, please stop saying that "the NSA employs an estimated 40,000 people plus thousands of private contractors, and spends over $40 billion a year". Documents leaked in August established definitively that the U.S. Consolidated Cryptologic Program (which includes military SIGINT personnel as well as NSA personnel) employs about 35,000 people (contractors not included) and has a total budget of about $10.8 billion (see Barton Gellman & Greg Miller, "U.S. spy network’s successes, failures and objectives detailed in ‘black budget’ summary," Washington Post, 29 August 2013).

Update 11:00 pm 10 December 2013: To its credit, CBC has now placed two somewhat redacted pages of the four-page document online. Two of the redactions, from a paragraph marked confidential, probably name the U.S. and Canadian liaison officers based in Ottawa (SUSLO/O) and Washington (CANSLO/W) respectively. The other redactions seem to list countries of interest to CSEC and NSA and some of the locations of covert Canadian listening posts -- Havana and one or two others? Presumably the two missing pages contain the really sensitive stuff, because these pages are pretty basic.

I understood the statement in yesterday's CBC story that "Canada is involved with the huge American intelligence agency in clandestine surveillance activities in 'approximately 20 high-priority countries'" to mean that Canada has covert intercept sites in approximately 20 countries. What we can see in the document, however, says only that "NSA and CSEC cooperate in targeting approximately 20 high-priority countries." And that line appears in a paragraph titled "What NSA provides to the partner". So it is not at all clear how many of those countries may contain Canadian monitoring sites. Perhaps the other two pages of the document spell this out or perhaps they don't.

Interesting additional tidbit in the part of the document CBC released: "No Consolidated Cryptologic Program (CCP) money is allocated to CSEC, but NSA at times pays R&D and technology costs on shared projects with CSEC." That probably explains the purpose of this money, but it would still be very interesting to know what those shared projects are.

CBC now has a follow-up story on their website: Greg Weston, "Canada’s electronic spy agency says tracking allies is necessary," CBC News, 10 December 2013. More on that in a later post.

Forster testimony, 28 November 2013

CSEC Chief John Forster's 28 November 2013 testimony to the House of Commons' Standing Committee on National Defence can be read here.

Former radio spy interviewed

Ottawa Citizen columnist Dave Brown profiles Gordon Grant, one of the former Frozen Chosen about his Cold War career (Dave Brown, "The coldest of the Cold Warriors," Ottawa Citizen, 8 December 2013).

More on CFS Alert and CFS Leitrim. List of other locations where Canadian SIGINT personnel have been posted.

See also the Online Oldtimers website.

Thomas Drake on NSA/CSEC threat to democracy

Former senior NSA executive turned whistleblower Thomas Drake gave a talk titled "Secret NSA/CSEC Surveillance versus Democracy: What's at Stake for the US and Canada?" at the University of Toronto iSchool on December 5th.

The full talk can be watched on Youtube here.

Update 9 December 2013: You can also listen to an interview of Drake by Michael Enright on The Sunday Edition, 8 December 2013.

Forcese on Mosley on Five Eyes assistance to CSIS/CSEC

Law professor Craig Forcese has written a very useful article explaining why Justice Richard Mosley's 2009 decision (background discussion here and here) concerning the ability of CSIS and CSEC to monitor Canadians abroad did not in Mosley's view authorize those agencies to use the intercept facilities of Canada's Five Eyes allies (Craig Forcese, "Triple Vision Accountability and the Outsourcing of CSIS Intercepts," National Security Law blog, 6 December 2013).

Forcese also discusses the implications for CSIS and CSEC now that Justice Mosley has clarified that "the use of 'the assets of the Five Eyes community' is not authorized under any warrant issued to CSIS pursuant to the CSIS Act. The question of whether CSIS may, with the assistance of CSEC, engage the surveillance capabilities of foreign agencies was not raised in the application that resulted in the issuance of the first such warrant or in any subsequent warrants of this type." [You can read the public version of Mosley's Further Reasons for Order here.]

Forcese comments,

On a substantive level, these developments raise important and intriguing questions.

• If five eyes assistance was not authorized, and CSEC and CSIS nevertheless sought it, are they still protected from Criminal Code, Part VI culpability? Where Part VI applies, culpability is only avoided where the intercept is lawfully authorized. If the parameters of the warrant were disregarded, does that vitiate the lawful access? I don't know the answer to this question, since it is impossible really to say without knowing more about the communication intercepted and whether it met the pre-requisites of Part VI in the first place.
  
• If CSEC and CSIS called on five eyes agencies to intercept communications, was the intercept still territorial, thus satisfying the international law concerns raised in the two warrant applications? It would be the height of shear nonsense for Canada to say: "We didn't violate international law, because we made sure that when our allies sent us the intercept, we first listened to its content in Canada. That made it 'territorial' even though the communication was actually first seized overseas by a foreign spying agency acting at our behest". Outsourcing an international violation does not diminish state responsibility for that international violation. In a different context, that would be like asking bounty hunters to do your kidnapping of fugitives on the territory of a foreign state. Still a violation of international law! (We could quibble about which rules of state responsibility reach this kind of interdelegation of spying, but I don't imagine establishing this responsibility would be much of an uphill battle).

If the answer to question 2 is "yes, there was violation of international law by proxy", then the CSIS/CSEC outsourcing makes a mockery of both Justice Blanchard and Justice Mosley's decisions. I certainly look forward to reading the public versions of the latter.

But whatever the content of this decision, it is screamingly evident that our lawful access rules have not kept pace with the times. I sympathize with CSIS -- it can't be blind just because dangerous Canadians go overseas. And I sympathize with the Courts -- they haven't been given legal tools that make it easy to square the circle between "keeping our eyes open internationally" and "complying with the law". And so I'll end with where I ended in my 2010 article:

The Canadian Federal Court decision [by Blanchard J.] is illustrative [of the pernicious consequences stemming from creative ambivalence of international law on spying]: in that case, CSIS sought to square what it perceived to be its domestic constitutional obligations with its international practices. In so doing, it asked a court to authorize conduct that, from first principles, gave every appearance of violating core precepts of the sovereignty norm, in circumstances where international scholars themselves debate the exact state of the law. The court acted reasonably in erring on the side of caution and refusing to give judicial blessing to conduct that, if revealed, would create thorny problems in international relations.

As noted, it will be no simple thing to overcome this caution by legislative amendment. No Canadian politician – cognizant of Canada’s modest position in the hierarchy of nations – will enthusiastically endorse an amendment that authorizes emphatically what other states only accept tacitly: that extraterritorial spying is permissible.

In the result, CSIS has a choice: conduct extraterritorial spying without recourse to the courts, at risk of ultimately being called to account under domestic law, or honor the Federal Court’s construal of international law (and CSIS’s jurisdiction) and pull in its truly international surveillance operations, potentially blinding the country’s chief security intelligence agency. This is not a happy situation, and it is a consequence at some level of a failure by the international community to extend a legal imprimatur to the reality of international spying.

Three years later, it is probably time for the government to gird itself with courage and think about clarifying the CSIS Act. [End of Forcese quotation]

It sounds like the end product has really hit the fan on this one.

Have CSIS and CSEC been acting unlawfully, albeit perhaps inadvertently, over the last four years?

If so, will the CSE Commissioner actually declare that to be the case, and thus ruin the government's favourite CSEC talking point? ("That independent commissioner has indicated, for the last 16 years, that CSEC has complied with all Canadian laws.")

Will the Federal Court find a new basis for permitting CSIS/CSEC to utilize Five Eyes capabilities for monitoring Canadians abroad? Alternatively, will parliament act to change the law so as to authorize such activities? Presumably the offending acts have been stopped in the meantime. What are the consequences of that? And there's more. Forcese's analysis seems to suggest that when it comes to activities such as actively penetrating foreign communications systems or even the target's own computer when it is located in a foreign country, even Mosley's decision, which permitted CSIS and CSEC to conduct such activities when it is for the purpose of collecting information on CSIS targets, may be on shaky legal ground. (CSEC collection of intelligence on foreign targets abroad would not be affected by this issue, however.) Update 20 December 2013: Added link to the public version of the 22 November 2013 Further Reasons for Order.

Canada's first cryptanalytic target was in Brazil

A little footnote to the recent controversy concerning CSEC spying in Brazil (see also here):

Canada's first codebreaking agency was the Examination Unit (XU), and the XU's very first target was a German spy who was based in Brazil.

The XU began operations in June 1941, housed in rooms 202 and 203 in the National Research Council Annex on Montreal Road in Ottawa. Headed initially (but not for very long) by the infamous American codebreaker Herbert Yardley, the XU began by working on the encrypted radio communications of the German intelligence service, the Abwehr, between South America and the main Abwehr radio station at Hamburg.

As an internal history of the XU later noted, "The first success of the office was in the German Abwehr traffic to South America. It was not long before we had succeeded in breaking into this and soon had a complete list of keys and read the traffic regularly. The system used was at first a simple transposition [redacted]. The Army picked up the messages at their Rockcliffe station and we received them direct from there. Most of this traffic concerned shipping up and down the coast of South America, with occasionally a message from some spy in the U.S." John Bryden's 1993 book Best-Kept Secret (p. 54) specifies that the first Abwehr messages worked on by the XU (received by the unit on 16 June 1941) were those of German agent Friedrich Kempter, who headed a small network of German agents in Brazil.


Update 26 February 2018:

As it happens, Brazil was also one of the four initial SIGINT targets of the CBNRC when it began operations in 1946.

NSA G8/G20 summit document released

CBC has released the full text (with minor redactions) of the NSA document discussing coverage of the 2010 G8/G20 summit in Canada (earlier discussion here and here).

More here: Greg Weston, "NSA document raises questions about Canada in G8 spying," CBC News, 2 December 2013.

Update 8:30 pm 2 December 2013: Christopher Parsons discusses the CBC's redactions: "The Oddities of CBC’s Snowden Redactions," Technology, Thoughts & Trinkets blog, 2 December 2013.

Update 5 December 2013: Matt Gurney questions whether the NSA document really says what the CBC said it does: Matt Gurney, "‘Supporting documents’ for CBC’s bombshell NSA scoop don’t support the story much at all," National Post, 3 December 2013.

He makes some fair points, I think, although (like Gurney) I don't doubt that Canada and its allies actually did monitor the event. I would guess, however, that CSEC took the lead on whatever was actually done and that CSIS did much of the direct collection, while NSA and (probably) GCHQ provided only relatively limited support. Note that the Canadian government didn't actually deny eavesdropping on the summiteers; it only denied breaking the law, and in that I think it was telling the truth.

Metadata and Second Parties

The Guardian has an article concerning the discussions at a metadata conference held by the Five Eyes partners at GCHQ's headquarters in Cheltenham in April 2008 (Ewen MacAskill, James Ball & Katharine Murphy, "Revealed: Australian spy agency offered to share data about ordinary citizens," Guardian, 2 December 2013). The article, based on another of the documents leaked by Edward Snowden, is focused on Australia's agency, the Australian Signals Directorate. But it also provides some information on CSEC's policy towards metadata at that time.



As the snippet above shows, the leaked document, a draft set of minutes for the metadata conference, reports that

CSEC are able to make use of unselected metadata for developing their capability. However, bulk, unselected metadata presents too high a risk to share with second parties at this time, because of the requirement to ensure that the identities of Canadians or persons in Canada are minimised, but re-evaluation of this stance is ongoing.

In the context of the Guardian story, CSEC's approach shows commendable concern for privacy compared to ASD's comparative lack of concern.

However, the snippet raises a number of important questions about CSEC and metadata.

• The snippet suggests that CSEC had access in 2008 to "bulk, unselected metadata" pertaining to the communications of Canadians and persons in Canada. How much bulk metadata pertaining to Canadian communications did CSEC have access to? On what legal grounds? And for what purpose? What access does CSEC now have?
  
  
• The snippet also suggests that CSEC would have been willing to share such data with its Five Eyes partners as long as Canadian-related identity information were "minimised". Was this eventually done? And what would minimization entail? What procedures would be put in place for other countries to retrieve Canadian identity information when that data is deemed relevant to further investigations?
  
  
• The snippet reports that "re-evaluation of this stance is ongoing." What decisions were eventually made? A new version of CSEC policy document OPS-1-10 (Procedures for Metadata Analysis [redacted]) was promulgated in September 2008. Did this document contain changes in CSEC's procedures for sharing metadata? What is the current procedure?
  
  
• There is evidence that NSA (and presumably Canada's other Five Eyes allies) currently do have access to a significant amount of Canadian metadata. Is this data supplied by Canada? What privacy rules are in place concerning the content and use of this data?