2023-24 was CSE's first billion-dollar year
The Public Accounts of Canada 2024, tabled in parliament on December 17th, confirm that fiscal year 2023-24 was CSE's first billion-dollar year. The agency spent $1,010,795,977 during the fiscal year that ended on March 31st, 2024.
CSE has been growing almost continuously since 2001. Its 2001-02 budget was originally projected to be $100 million, or about $173 million in today's dollars — just over one-sixth of its 2023-24 spending. That's probably about what the agency would have ended up spending that year had it not been for the 9/11 attacks, which completely changed the budget picture. The actual amount CSE spent that fiscal year was $189 million, or about $327 million in 2024 dollars.
But while the "Global War on Terror" was responsible for the initial boosts in CSE's spending in the years that followed, what really kept the money taps flowing was the explosive growth of the Internet and ubiquitous computing, which created a vast new source of intelligence ripe for the gathering, new forms of vulnerability that required a greatly expanded cybersecurity response, and, more recently, a global arena for cyber-enabled operations.
It's that transformation that has kept CSE growing for more than two decades and that keeps it growing still.
The Supplementary Estimates (B), 2024-25, tabled in November, boosted CSE's fiscal year 2024-25 budget authority to $1,126,635,267.
We'll have to wait for next year's Public Accounts to see what the actual amount that is spent this year turns out to be, but even further growth is in the plan. In October, CSE Chief Caroline Xavier stated that the agency expects to have more than 4,000 — almost 5,000 — employees by the time its currently approved growth is done. As of 31 March 2024, the agency had 3,529 employees.
Spending by program
Little information is released about the details of CSE's spending, but the GC Infobase does provide a breakdown of that spending into broad programs that is updated every year after the Public Accounts come out.
(See here for further discussion of these categories.)
Of particular interest is the information on CSE's Foreign Cyber Operations (FCO) program, under which the agency executes its active cyber operations and defensive cyber operations mandates. This is one of the few windows we have into the scale of that program.
In 2022-23, the first year for which these data were provided, $9,145,757.10 was spent on the FCO program. The $11,932,939.20 total recorded for 2023-24 is 30% higher than 2022-23's total. It still accounts for just 1.2% of CSE's overall budget, however.
In personnel terms, that might translate into as many as 90 full-time equivalent (FTE) employees in the FCO program, although it could be as few as 40 if administrative, accommodation, and other support costs are included in the spending total. These are very small numbers in comparison to CSE's overall staff, but — guessing wildly here — CSE may not need more than a few hundred operators in the FCO program, at least in the near future. Even at its current size, the cyber operations program may be approaching the scale where CSE can contemplate sustained, simultaneous operations against at least a couple of objectives, particularly if conducted in cooperation with other partners.
On that question, CSE has acknowledged that it takes part in, and even sometimes leads, combined cyber operations with international partners, and it also has domestic partners, most notably the Canadian Armed Forces' Cyber Command (CAFCYBERCOM).
CAFCYBERCOM's capabilities are themselves still nascent, but for a decade now CSE and the armed forces have been slowly building the capacity to conduct combined cyber operations through their Combined Cyber Unit (CCU), a joint CSE-CAF entity that can operate under CSE authorities, CAF authorities, or a blend of the two.
It will be interesting to see how CSE's (and the CAF's) cyber operations capabilities evolve as time goes on.
posted by Bill Robinson at 12:42 pm
0 comments
