On November 4th, the National Security and Intelligence Committee of
Parliamentarians (NSICOP) released the public version of its report on the security and intelligence activities of Global Affairs Canada (GAC),
otherwise known as the Department of Foreign Affairs, Trade and Development.
There's a lot of new information in the report about GAC's role in the
Canadian intelligence community as overseer, facilitator, collector, assessor,
and consumer of intelligence. It's well worth reading.
In the following, I'll focus on what the report says about how Global
Affairs works with the Communications Security Establishment.
GAC–CSE relationship
On page 24 (PDF page 33), NSICOP describes the
overall relationship between CSE and Global Affairs:
GAC's
collaboration with CSE ... dates back to the creation of CSE in 1946. GAC has
long been a client of CSE's foreign intelligence collection ***. While GAC has
had a formal consultation role for some of CSE's most sensitive activities
since 2002, the coming into force of the CSE Act in 2019 provided GAC a more
significant role in CSE's new authorities for cyber operations.
(NSICOP uses "***" to indicate where information
that was in the classified version of the report has been redacted.)
GAC
and CSE formalized their cooperation with the signing of a General Framework
Agreement in 2009. The agreement recognized the organizations' cooperation in
the collection of foreign intelligence, their long-standing collaboration on
the implementation of Canada's Export Control legislation, and their response
and handling of cyber incidents targeting GAC. (p 24/PDF 33)
Take note of that mention of "the organizations' cooperation in the
collection of foreign intelligence"; we'll return to that point later on.
Computer Network Exploitation
Next we get a quick look at GAC's oversight of CSE computer hacking
operations used to collect intelligence from information technology systems and
networks, more formally known as Computer Network Exploitation (CNE).
All mentions of CNE are redacted from NSICOP's report, but it is clear from
the context that CNE is the subject. (For more fun with CNE redactions, see here.)
The first formal agreement
on consultation between CSE and GAC concerned the agency's *** activities.
These activities use *** for the purpose of collecting foreign intelligence. In
2002, GAC and CSE signed a memorandum of understanding under which CSE would
inform GAC prior to undertaking its most *** outside of Canada. (p 24/PDF 33)
The CNE memorandum of understanding was signed by the Minister of National
Defence on 23 April 2002.
The agreement also granted
GAC a role in challenging CSE's conduct of certain activities ***. While the
2002 memorandum of understanding remains in place, the two organizations
streamlined elements of the agreement in 2015. (p 24-25/PDF 33-34)
GAC's role is to make sure the potential risks/rewards of CNE operations are
assessed in the context of Canada's overall foreign policy.
Foreign relationships
CSE is also required to consult GAC before entering
into any arrangements with foreign states or institutions. Since the 2019 entry
into force of the CSE Act, it has been a statutory requirement that the
Minister of National Defence consult the Minister of Foreign Affairs before
approving such arrangements.
Given
the recent nature of this authority, CSE has not consulted GAC prior to
entering into such an arrangement at the time of writing. (p 25/PDF 34)
Defensive cyber operations (DCO)
The CSE Act also requires the Minister of National Defence to consult the
Minister of Foreign Affairs prior to issuing an authorization for defensive
cyber operations (DCO). DCOs are cyber operations designed to protect Canadian
government networks or systems designated as being of importance to the
government.
The Minister of National
Defence issued the first authorization for defensive cyber operations in ***
2019. CSE officials developed this authorization in consultation with GAC. (p
26/PDF 35)
Although redacted here, the date of the authorization was 5 September 2019,
as reported by NSICOP in its February 2022 cybersecurity report (p 77/PDF 89).
The November report provides some additional details on GAC's contribution:
At
the operational level, GAC provides foreign policy risk assessments for all of
CSE's planned defensive cyber operations. As part of its assessment of the
proposed operation, GAC considers potential implications for Canadian
interests, the operation's compliance with international law and cyber norms,
alignment with broader foreign policy interests, the nature of the target (***)
and whether the operations ***. (p 26/PDF 35)
Also interesting is this bit of news:
Between *** and *** , CSE
planned but did not conduct any defensive cyber operations, because separate
defensive cyber measures taken by CSE obviated the need for the planned cyber
operations. (p 26/PDF 35)
It would be even more interesting, of course, if unredacted dates were provided.
Fortunately, NSICOP's February 2022 report (p 96/PDF 108) did provide that
information, stating that no DCOs were conducted during the first two
DCO authorization periods (i.e., from September 2019 to August 2021).
That report also informed us that, "in the first year, normal cyber
defence activities successfully mitigated the threat and obviated the need for
a separate operation and in the second year, planned operations had not
proceeded to the operational stage." (p 96/PDF 108)
It would be interesting to know if any DCOs have yet been conducted.
S.16 activities
Under s.16 of the CSIS Act, CSIS can collect foreign intelligence
"within Canada" on request of either the Defence Minister or the
Foreign Affairs Minister. This might entail monitoring the communications of an
embassy in Ottawa, for example.
CSE often helps with technology, processing, and reporting of the intelligence that results from s.16 collection, and GAC plays a role as a requestor, assessor of foreign policy
risk, and intelligence client.
In
2008, officials from participating organizations introduced a formalized
governance model [for the s.16 program], which included a requirement to assess
potential subjects against criteria linked to Canada's intelligence priorities
and a permanent oversight committee structure (the *** Committee) with the
responsibility to evaluate and endorse section 16 rationales before they are
submitted for approval to the relevant ministers. (p 38/PDF 46)
All information about the committee, including its name, is redacted from
NSICOP's report.
By contrast, a 2015 report by OCSEC, CSE's first watchdog agency, described
the committee structure in detail, and this information was later released
mostly unredacted to reporter Colin Freeze via Access to Information request
A-2015-00082.
Some of the details may have changed since then, but if the information was
releasable at that time, why not now?
Active cyber operations (ACO)
The CSE Act also "allows CSE
to conduct active cyber operations to degrade, disrupt, influence or interfere
with the capabilities or intentions of foreign entities." (p 41/PDF 49)
In recognition of the
foreign policy implications of these activities, the Act stipulates that the
Minister of National Defence may issue this authorization only if the Minister
of Foreign Affairs has requested or consented to its issue. (p 41/PDF 49)
Note that this differs from DCOs, which require only consultation with the Foreign Affairs Minister.
"The Minister of National Defence issued CSE's first authorization for
active cyber operations in 2019" (p 41/PDF 49), i.e., shortly after the CSE Act came into force.
The 2019 Annual Report (p. 25) of the
National Security and Intelligence Review Agency (NSIRA) also confirmed that an
ACO authorization was issued that year.
But NSICOP's report goes on to provide considerably more information than was
released previously:
Between 2019 and 2020, CSE
planned four active cyber operations and carried out one. (p 41/PDF 49)
The ACO that was carried out sought to "disrupt the activities of
terrorists and violent extremists." (p 41/PDF 49)
The three ACOs not conducted sought "to disrupt foreign cyber threats
to the 2019 federal election"; "to counter the dissemination by
specific terrorist groups of extremist material on-line"; and "to
mitigate threats posed by foreign cybercriminal groups targeting
Canadians". (p 41-42/PDF 49-50)
The election-related ACO was not conducted "because no specific
state-led operations were detected", while the other two did not get done
"due to operational restrictions arising from COVID". (p 41-42/PDF
49-50)
(For more on the effect of the COVID-19 pandemic on the Canadian security and
intelligence community, see this book.)
In August 2019, the
Minister of Foreign Affairs directed GAC officials to work with CSE to develop
a formal governance mechanism to ensure CSE's cyber operations align with
Canada's foreign policy and international legal obligations. (p 42/PDF 50)
This led, in 2020, to the creation of "the CSE–GAC Active Cyber
Operations/Defensive Cyber Operations Working Group and a comprehensive
governance framework for consultation on cyber operations". (p 42/PDF 50)
The report also reveals that, inside CSE, "the
Cyber Operations Group and the Cyber Management Group oversee CSE's cyber
operations. These are executive bodies, at the director- and director
general-level respectively, that review and approve cyber operation plans and
risk assessments. The Director of *** and the Deputy Chief of Signals Intelligence
chair the respective committees, and membership depends on ***." (p 43/PDF
51)
This is the first official confirmation, I think,
that CSE's cyber operations are lodged in the agency's SIGINT branch.
Interestingly, NSIRA also recently looked at the GAC–CSE relationship with respect to the governance of ACO/DCO
activities.
Among other findings, NSIRA stated that "CSE
and GAC have not established a threshold to determine how to identify and
differentiate between a pre-emptive Defensive Cyber Operation and an Active
Cyber Operation, which can lead to the insufficient involvement of GAC if the
operation is misclassified as defensive." (p 69/PDF 77)
In total, NSIRA made nine recommendations for improvements
relating to "engaging other departments to ensure an operation’s alignment
with broader Government of Canada priorities; demarcating an ACO from a
pre-emptive DCO; assessing each operation’s compliance with international law;
and communicating with each other any newly acquired information that is
relevant to the risk level of an operation." (p 21/PDF 29)
The full set of findings and recommendations can be
found on pages 69-71 (PDF 77-79) of NSIRA's report.
PILGRIM's progress
Getting back to NSICOP, the next two pages of the committee's report (p 44-45/PDF
52-53) discuss a program that is ostensibly so secret that all information is
redacted except for one sentence: "GAC states that it derives its
authority for the program from the Crown prerogative." (p 44/PDF 52)
This is clearly the program — known at one time as PILGRIM — for the operation of CSE
intercept facilities inside Canadian diplomatic missions, our equivalent of U.S.
Special Collection Service sites.
Presumably it was this program that NSICOP was alluding to when (as I noted
at the beginning of this post) it mentioned GAC and CSE's "cooperation in
the collection of foreign intelligence". (p 24/PDF 33)
All of the Five Eyes partners operate such intercept sites, known
collectively under the coverterm STATEROOM, but the official policy is to
pretend no one knows Canada does this sort of thing, so even the fact of its
existence remains classified. That rare allusion is as close as we get to an
official confirmation.
Still, NSICOP did manage to flag some concerns about GAC's role in the
program in its descriptions of three of the redactions (p 45/PDF 53):
1. "The paragraph noted that the Department does not have any policies,
procedures or documents to govern its involvement, and does not have any
reporting requirements to the Minister".
2. "The paragraph noted challenges regarding the management of
risk."
3. "The paragraph noted the Department's failure to inform the Minister
of important issues."
One of the report's four recommendations was probably aimed in part at this
program:
R3. [NSICOP recommends that
the] Minister of Foreign Affairs put in place comprehensive governance
mechanisms for the Department's security and intelligence activities and for
those that it supports or contributes to at partner organizations. Those
mechanisms should better document processes and decision points to strengthen
accountability and institutional memory. (p 95/PDF 102)
Intelligence Access and Countermeasures section
A few pages after the intercept sites discussion — past another almost
entirely redacted part called "Logistical Support ***" that probably
discusses GAC's occasional provision of support to Five Eyes partner HUMINT
agencies like MI6 and the CIA — is a chapter on GAC's own intelligence
activities.
There is a lot of very useful and rarely if ever reported information in
there about what Global Affairs itself does in this field, but for my purposes
I want to highlight just one aspect:
In 2017, GAC established a
division within the Intelligence Bureau responsible for the management of
highly classified communications at missions abroad. This Intelligence Access
and Countermeasures section works closely with CSE to accredit and protect
GAC's signals intelligence secure areas. (p 51-52/PDF 59-60)
("Signals intelligence secure area" (SSA),
by the way, is the Canadian SIGINT community's equivalent for what in the U.S. is
known as a secure compartmented information facility, or SCIF.)
NSICOP's description of the Intelligence Access and Countermeasures section gives
the impression that it deals only with GAC's own communications, and maybe it
does do only that. But the fact that "Intelligence Access" is included
in the section's name may indicate that it also looks after the intercept sites
at the missions, which of course also would be located in SSAs.
A probably much less likely theory is that the unit is also mandated to conduct close-access operations, which are designed to enable SIGINT
collection by placing antennas or other collection systems in close proximity
to targeted information technology systems and/or installing hardware or software
implants directly in them.
The foreign intelligence collection authorities
granted to CSE in the CSE Act
are broad enough to encompass close-access activities:
The
foreign intelligence aspect of the Establishment’s mandate is to acquire,
covertly or otherwise, information from or through the global information
infrastructure, including by engaging or interacting with foreign entities
located outside Canada or by using any other method of acquiring information,
and to use, analyse and disseminate the information for the purpose of
providing foreign intelligence, in accordance with the Government of Canada’s
intelligence priorities. (s.16)
And the agency could, with Global Affairs' agreement,
deputize GAC personnel to conduct such operations on its behalf.
However, heads far wiser than mine consider it all but inconceivable
that any Canadian government would ever muster the will to attempt such
inherently perilous operations, with their potential for embarrassing exposure and,
worse, risk to the life or liberty of the individuals participating.
Also, we might expect there to be a lot more discussion of the topic in this report if the section's role really did extend that far. (That
said, it's not impossible that there is such a discussion buried in the redacted parts of the report concerning intercept sites.)
I'm probably letting my imagination run away with me when it comes to close-access ops. But I'll keep pondering
that imponderable because certain comments made by CSE's former Deputy Chief SIGINT way back in 2007 leave me strongly inclined to believe that CSE would very much like the government to conduct such operations for it.
There is a lot of other valuable information about GAC's intelligence role
in this report, but that pretty much covers the CSE-related aspects.
Redactio
ad absurdum
I will make one final complaint about pointless redactions, however. On pages
75-78 (PDF 83-86) there is a case study of a kidnapping incident involving a
Canadian from which almost all personal details have been redacted.
Maybe it's intended as a privacy thing, but it only takes about a minute on
Google to fill in all those blanks.
