CSEC and targeting rules

One of the Snowden documents released yesterday by the Washington Post (Ellen Nakashima & Barton Gellman, "Court gave NSA broad leeway in surveillance, documents show," Washington Post, 30 June 2014) contains this interesting comparison of the rules that control spying by the Five Eyes countries on their own nationals and/or within their own territory:



(Original document here.)

At first glance, CSEC looks pretty good from a privacy point of view, operating under what appear to be much more restrictive rules than its Five Eyes partners.

But the distinction is without a difference.

CSEC does not have the power to target Canadians, but other agencies of the Canadian government do. CSIS and the RCMP (and potentially other law enforcement or security agencies) have the ability to obtain judicial warrants to target the communications of specific persons of any nationality within Canada or of Canadians, whether within Canada or abroad, and these agencies can then proceed to enlist the assistance of CSEC in performing that targeting.

This was made very clear in the original Mosley decision in January 2009, which authorized CSEC to monitor specific targeted Canadians outside Canada on behalf of CSIS, based on CSIS warrants. (The subsequent imbroglio concerning the use of these warrants was related to the participation of other Five Eyes partners in the monitoring, not to CSEC's participation.)

"Cannot target Canadians", which is the comment in the "National overseas" column, doesn't really capture the reality of this situation.

And the same applies to the "National in ..." and "Foreign national in ..." columns. The former case is documented here, and the latter is discussed here.

In short, the actual situation is very different from the happy picture depicted on the chart.

Each of the Five Eyes countries has its own unique legal and policy regime, but broadly speaking the rules under which CSEC operates are very similar to those under which its partners operate.