CSE wins big in 2018 budget

The 2018 budget, tabled by the Finance Minister on February 27th, promises some big spending boosts for the Communications Security Establishment over the next five years, with additional money pledged for both the IT Security and the SIGINT programs.

For starters, the government is promising to spend $507.7 million over the next five years, and $108.8 million per year thereafter, to fund a new National Cyber Security Strategy (NCSS). $155.2 million of that sum, and $44.5 million per year ongoing, will be provided to CSE to create a new Canadian Centre for Cyber Security (see pages 203-205):

By consolidating operational cyber expertise from across the federal government under one roof, the new Canadian Centre for Cyber Security will establish a single, unified Government of Canada source of unique expert advice, guidance, services and support on cyber security operational matters, providing Canadian citizens and businesses with a clear and trusted place to turn to for cyber security advice. In order to establish the Canadian Centre for Cyber Security, the Government will introduce legislation to allow various Government cyber security functions to consolidate into the new Centre. Federal responsibility to investigate potential criminal activities will remain with the RCMP.

To carry out its responsibilities, the RCMP will get a new National Cybercrime Coordination Unit funded to the tune of $116.0 million over five years, and $23.2 million per year after that.

The rest of the NCSS money, $236.5 million over five years and $41.2 million per year after that, will go "to further support Canada’s new National Cyber Security Strategy." At the moment, however, it appears that none of that additional money will flow CSE's way.

Even more money will be provided to "modernize/enhance the Government’s digital services" (see page 206): "$2.2 billion over six years, starting in 2018–19, with $349.8 million per year thereafter, [will be spent] to improve the management and provision of IT services and infrastructure within the Government of Canada, and to support related cyber security measures." Most of that cash will be going to Shared Services Canada, but an unspecified portion of it is promised to CSE.

[Update 28 February 2018: According to the Defence Minister's office, CSE will receive a total of $16 million over six years from this funding.]

Meanwhile, new money is also promised to the SIGINT program (see page 208): "In order to keep pace with rapid technological change that can challenge its ability to effectively collect foreign signals intelligence, the Government proposes to provide the Communications Security Establishment $225 million over four years, starting in 2020–21, and $62.1 million ongoing, to ensure this capability is preserved."

If these promised budget boosts are fully implemented, the new IT Security and SIGINT money will eventually total an extra $106.6 million a year for CSE, plus whatever money comes from the digital services initiative and any additional National Cyber Security Strategy money that ends up in CSE's coffers. [The information I received from the Minister's office indicates that these amounts will be minimal.] If no other changes are made to CSE's budget in the interim, this would represent an increase about 18%—large, but not quite of the scale of the increase (25%) the agency received in the immediate wake of 9/11.

Even at 18%, it is likely that the new funding will mean significant new growth in CSE's staff. Currently at about 2300 employees, the agency could eventually grow to 2700 or even more, although it is possible that a significant number of those bodies might end up working for contractors instead and thus wouldn't appear on the employee rolls. The SIGINT side alone could easily expand by 300 people, which would enable development of a significant Computer Network Attack capability as well as support growth of more traditional intelligence-gathering activities.

These are pretty big numbers.

For now, however, most of the money exists only in the political fantasyland of distant budget-year promises. We probably won't even know what all of this means for the fiscal year about to start until the 2018-19 Main Estimates are released, which, according to this new thing called Interim Estimates, could be as late as mid-April. Stay tuned for that.

The government's decision to dedicate significant additional resources to national cyber security and to concentrate that effort in one organization, much as the British and some of our other allies have done, is a good one, I think. As to whether it will be sufficient to address the threat, I have no idea. I assume we'll get some more details of what precisely is proposed whenever the National Cyber Security Strategy itself is released.

I'm undecided on the question of whether CSE should be the agency where the national cyber security effort is concentrated. CSE certainly has most of the expertise on this subject now, and to the extent that cyber security draws on intelligence-gathering efforts to detect, attribute, and counter such activities its involvement may be essential. But CSE's other mandates also pull it in the opposite direction, away for example from initiatives that might have the effect of making cyberspace as a whole a more secure place.

The fact that the same budget is promising to boost the SIGINT program—so as to preserve and/or increase Canada's ability to conduct its own Computer Network Exploitation and Attack operations—throws this whole aspect into rather stark relief. Intelligence-gathering is certainly valuable. The net benefits of CNA I'm less convinced about.

But as to whether those various imperatives are best balanced within a single agency or among two or even three agencies at the Cabinet/PCO level is, I think, a serious question that we seem at the moment to be answering by default.


News coverage:

Alex Boutilier, "Liberals pitch $500 million cyber security plan," Toronto Star, 27 February 2018.

Murray Brewster, "Federal budget shores up cyber defences but is silent on new jets and warships," CBC News, 27 February 2018.

Carl Meyer, "Budget targets 'increasingly sophisticated' cyber attacks on government," National Observer, 27 February 2018.

Jim Bronskill & Lee Berthiaume, "New federal cybersecurity strategy follows 'overlap, lack of clarity'," Canadian Press, 28 February 2018.

Canada's initial post-war SIGINT targets

When CSE, then called the Communications Branch of the National Research Council (CBNRC), began operations in September 1946, it had four SIGINT targets.

Set in consultation with Canada's U.S. and U.K. allies, those initial targets were selected primarily to provide a range of different training opportunities for the new agency. As the official History of CBNRC described it, "The basic purpose of these tasks was to provide initial training in producing intelligence from a variety of foreign communications and cipher systems."

Kurt Jensen's 2008 book Cautious Beginnings: Canadian Foreign Intelligence, 1939-51 identified those initial targets in general terms: "The cryptanalysis unit would focus on Europe, the Far East, and South America. The prime decryption assignments were in the French, Spanish, and Chinese languages, with only the latter representing a departure from wartime interests."

In fact, there was one other significant language in use... Portuguese.

Brazilian Portuguese.

The released versions of the History of CBNRC, particularly the 2015 release, provide a number of details about those initial tasks, but the identities of specific countries/languages tasked are redacted, meaning you have to work a bit to figure them out.

The best clues are to be found in the 2015 document's largely unredacted index, which has four significant gaps where the entries for Brazilian, Chinese, French, and Spanish used to be. As it happens, the 1990s release of the History redacted the names of those entries but not the lists of locations where the terms actually appear in the text. Thus, it is possible to check hypothesized names against the redacted terms in the 2015 text to see if their length and context make sense.

In the case of French, it is even possible to find the term unredacted in certain paragraphs (those that discuss bilingualism in the public service). The fact that no other term in those paragraphs matches the Fairley-to-GCCS gap in the index confirms that the redacted entry is indeed French. Chinese also appears once in the text in similar circumstances.

Collateral information, such as Marcel Roussin's background as a specialist in Latin American diplomatic history, is also helpful for solidifying the identifications.

With the four broad targets identified it is possible to fill in several of the blanks in the document, which in turn reveals a number of additional interesting details about these tasks:

• The Spanish task was focused on Spanish naval forces and depended to a significant degree on traffic collected by GCHQ. This quickly proved to be a problem. Higher priorities forced GCHQ to drop its coverage of the Spanish target by the beginning of 1947, leading CBNRC to abandon the Spanish task not long afterward. (It was replaced by CBNRC's first Russian task.)
• The French task focused on French military (i.e., army) and naval traffic. The Examination Unit had done a lot of work on both Vichy French and Free French systems during the war, so this was an area where Canada already had some experience. The French task also suffered from reductions in collection by GCHQ, however, and in October 1950 the decision was made to phase it out in favour of more Russian work.
• The focus of the Brazilian task is not clear. It may have included diplomatic or commercial traffic instead of or in addition to service traffic. The Brazilian task remained active until November 1956.
• The Chinese task, which seems to have consisted mostly of civil traffic, was the last to go, being dropped in November 1957. The end of the Chinese task coincided with CBNRC's decision, taken in conjunction with NSA and GCHQ, to focus the Canadian SIGINT effort from that time on almost entirely on the Soviet Arctic.

Five Eyes SIGINT governance: Meetings galore

The relationship among the Five Eyes SIGINT agencies is extraordinarily close. It is not that uncommon for intelligence agencies to cooperate with their foreign counterparts in limited ways on specific topics of mutual interest, but the depth and breadth of cooperation among the "Second Parties" to the UKUSA Agreement is truly remarkable.

Each of the five agencies that participate—NSA, GCHQ, CSE, ASD, and GCSB—remains an independent entity under national control and responding to national intelligence priorities, but in many respects they also work as a single, supranational entity, setting common goals, building interoperable systems, and sharing technology, people, and, to an extraordinarily large degree, raw and assessed intelligence.

Born in the darkest days of the Second World War and institutionalized for the post-war era by the BRUSA Agreement (subsequently renamed UKUSA) of 5 March 1946, the UKUSA community has only grown closer and more tightly integrated in the decades up to the present. In addition to the UKUSA Agreement and other, subsidiary agreements (notably the CANUSA Agreement), the allies jointly set common Strategic Directions, adopt Resolutions at consultative meetings, and sign memoranda of understanding on common projects and programs. Personnel serve on exchange inside allied collection, processing, and analysis sites, take training courses at allied facilities, and work in permanent liaison offices established at each other's agencies to ensure continued close cooperation. The agencies are even able to task some of the collection systems operated by their allies. Much of the metadata and in some cases raw content of the SIGINT the agencies collect is made accessible to the partners, and most of the SIGINT reports issued by the agencies—some 500 per day—are shared among the partners.

Senior executives of the agencies consult among themselves whenever major issues arise, hold regular monthly, in some cases weekly, teleconferences, attend annual meetings as a group, and also hold frequent bilateral meetings. Lower-level committees meet regularly to work out specific problems, facilitate specific areas of cooperation, or run shared programs, and regular conferences are held to share information or tradecraft. In the wake of 9/11, as the allies sought to extend their intelligence cooperation even further and move from the traditional ethos of "need to know" to a new one of "need to share", the number and nature of these meetings and conferences proliferated.

The internal newsletter of NSA's Signals Intelligence Division, SID Today, leaked by Edward Snowden, provides some insight into this aspect of UKUSA cooperation. I did a review of the SID Today articles written over the two-year period between June 2003 and May 2005 and found references to 49 conferences or other meetings involving the participation of two or more Five Eyes members. (The source articles can be found here.)



Note that this list contains only those meetings mentioned in SID Today. Thus, in addition to those NSA-related SIGINT meetings that may have gone unmentioned, it excludes all meetings pertaining to the cybersecurity activities of the agencies and most of the bilateral SIGINT meetings in which NSA was not a participant.

Several of the meetings listed (those marked with an asterisk) were described as the first in an ongoing annual series on that topic, demonstrating the extent to which consultation and sharing was expanding at this time. Many of the other meetings listed were already annual.

Broader Five Eyes relationship

The Five Eyes cooperative relationship is no longer merely an arrangement among cryptologic agencies. The partnership may have begun with SIGINT, but extensive intelligence-sharing has also long occurred among the Five Eyes' security-intelligence, human-intelligence, and military-intelligence agencies, both at the operations level and at the level of multi-source assessed intelligence, up to and sometimes including National Intelligence Estimates and equivalent documents. More recently, formal Five Eyes fora have also been created in such areas as law enforcement cooperation and critical infrastructure protection.

Sometimes these fora have also been extended, at least for limited purposes, to include other countries. The SIGINT Seniors Europe and SIGINT Seniors Pacific groupings are example of this development in the signals intelligence sphere.

I imagine the recent report that France has become part of a "Five Eyes plus France" group that meets one or more times a year in Washington (Pierre Tran, "French official details intelligence-sharing relationship with Five Eyes," Defense News, 5 February 2018) is an example of that trend with respect to broader intelligence cooperation. What I do not think it heralds, however, is anything remotely like the deep, wide-ranging, and day-to-day integration of activities that characterizes the unique SIGINT relationship among the UKUSA five.