Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2023: Backgrounder

Review of Federal Institutions’ Disclosures of Information under the Security of Canada Information Disclosure Act in 2023

Backgrounder

The Security of Canada Information Disclosure Act (SCIDA) is intended to facilitate information sharing across government for national security purposes. Disclosures under SCIDA tend to include considerable personal information, such as passport information, citizenship status, and information gathered by diplomatic missions.

NSIRA is responsible for annually reviewing disclosures made during the previous calendar year and submits a report with its findings and recommendations to the Minister of Public Safety.

Annual reviews of disclosures by NSIRA are key to ensuring that Government of Canada (GC) institutions use SCIDA in a manner that respects the Canadian Charter of Rights and Freedoms and the privacy rights of the individuals whose information is being disclosed.

This report describes the results of a review by NSIRA of SCIDA disclosures made in 2023. It was tabled in Parliament by the Minister of Public Safety, as required under subsection 39(2) of the NSIRA Act, on June 13 2025.

Since NSIRA began reviewing GC institutions’ compliance with the Act five years ago, it has made recommendations to promote higher levels of compliance among GC institutions. This has resulted in those institutions adjusting their practices and increasingly demonstrating an improved understanding of their obligations.

This year, for the first time in SCIDA’s history, NSIRA has found full compliance with the Act. As such, the report contains seven recommendations aimed at improving the practices of GC institutions to ensure that this high level of compliance is maintained.

Date Modified:: 2025-06-13

Review of Government of Canada Institutions’ Disclosures of Information Under the Security of Canada Information Disclosure Act in 2023: Report

Review of Federal Institutions’ Disclosures of Information under the Security of Canada Information Disclosure Act in 2023

Report

Table of Contents

List of Acronyms
Glossary of Terms
Executive Summary
1. Introduction
2. Background
3. Findings, Analysis, and recommendations
4. Conclusion
Annex A. Sample of Disclosures
Annex B. Cases Relating to IRCC’s Disclosure of Visa Information
Annex C. Overview of SCIDA Disclosures in Prior Years
Annex D. Findings and Recommendations

Date of Publishing:

June 13, 2025

Download PDF

List of Acronyms

CBSA	Canada Border Services Agency
CFIA	Canadian Food Inspection Agency
CNSC	Canadian Nuclear Safety Commission
CRA	Canada Revenue Agency
CSE	Communications Security Establishment
CSIS	Canadian Security Intelligence Service
DND/CAF	Department of National Defence/Canadian Armed Forces
FINTRAC	Financial Transactions and Reports Analysis Centre of Canada
GAC	Global Affairs Canada
GC	Government of Canada
IRCC	Immigration, Refugees and Citizenship Canada
NSIRA	National Security and Intelligence Review Agency
PHAC	Public Health Agency of Canada
PS	Public Safety Canada
RCMP	Royal Canadian Mounted Police
SCIDA	Security of Canada Information Disclosure Act
TC	Transport Canada

Glossary of Terms

Contribution test	The first part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (paragraph 5(1)(a)).
Proportionality test	The second part of the two-part threshold that must be met before an institution can make a disclosure under the SCIDA: it must be satisfied that the information will not affect any person’s privacy interest more than reasonably necessary in the circumstances (paragraph 5(1)(b)).

Executive Summary

The objective of this review was to determine whether Government of Canada (GC) institutions complied with the Security of Canada Information Disclosure Act (SCIDA)’s requirements for disclosure and record keeping in 2023. The review assessed GC institutions’ use of information-sharing arrangements, consistent with SCIDA’s guiding principles. The review also documented the volume of SCIDA disclosures and highlighted patterns in the SCIDA’s use across GC institutions and over time.

This is the fifth year that GC institutions have used the SCIDA and that NSIRA has reviewed their compliance with the act. Each year, NSIRA has made recommendations aimed at promoting compliance with the Act. Over the last five years, GC institutions have adjusted their practices and are increasingly demonstrating an improved understanding of their obligations. As a result, for the first time in SCIDA’s history, NSIRA found full compliance with the SCIDA. This allowed NSIRA to focus its review on in-depth analysis of the SCIDA’s contribution and proportionality tests.

For instance, some Immigration, Refugees and Citizenship Canada (IRCC) disclosures, albeit compliant with the SCIDA, presented a heightened risk of non-compliance with these two tests. One disclosure involving protest activity raised concerns regarding how IRCC arrived at the conclusion that the disclosure was related to activity that undermined the security of Canada, and thus complied with paragraph 5(1)(a) of the SCIDA. Three disclosures also raised concerns with regard to the amount of personal information that IRCC disclosed following its proportionality assessment, pursuant to paragraph 5(1)(b).

CSIS request letters, on which IRCC often relies to assess compliance with subsection 5(1), were at times unclear. This hindered IRCC’s effort to satisfy itself that the disclosure was authorised under the SCIDA.

IRCC provided templated statements on accuracy and reliability that were not always relevant or specific to the circumstances of the disclosure. In one case, the Canada Border Services Agency (CBSA) made a verbal disclosure that did not include an explicit statement about accuracy and reliability at time of disclosure. In addition, CBSA’s record of disclosure form contradicts the SCIDA by suggesting that the provision of information on accuracy and reliability is optional.

As encouraged by the SCIDA’s guiding principles, and as recommended by NSIRA previously, IRCC and the Communication Security Establishment signed an informationsharing agreement.

NSIRA made seven recommendations to mitigate risks of non-compliance and enshrine best practices in future years.

1. Introduction

Authority

This review was conducted pursuant to subsections 8(1)(b) and 39(1) of the National Security and Intelligence Review Agency Act (NSIRA Act).

The review satisfies the NSIRA Act’s section 39 requirement for NSIRA to submit a report to the Minister of Public Safety on disclosures made under the Security of Canada Information Disclosure Act (SCIDA, Act) during the previous calendar year.

Scope of the Review

The objective of this review was to determine whether Government of Canada (GC) institutions complied with the SCIDA’s requirements for disclosure and record keeping. The review assessed GC institutions’ use of information-sharing arrangements, consistent with SCIDA’s guiding principles. The review also documented the volume of SCIDA disclosures and highlighted patterns in the SCIDA’s use across GC institutions and over time.

The review included all GC institutions that disclosed or received information under the SCIDA in 2023: the Canada Border Services Agency (CBSA), Communications Security Establishment (CSE), Canadian Security Intelligence Service (CSIS), Global Affairs Canada (GAC), Immigration, Refugees and Citizenship Canada (IRCC), and Royal Canadian Mounted Police (RCMP). The review also included Public Safety Canada (PS), which provides SCIDA-related policy guidance and training across the GC.

Methodology

NSIRA assessed administrative compliance with the SCIDA’s record keeping obligations in respect of all disclosures made in 2023.

NSIRA assessed substantive compliance with the SCIDA’s disclosure requirements for a targeted sample of 27 disclosures, selected according to the parameters described in Annex A.

Review Statements

The NSIRA Act grants NSIRA rights of timely access to any information in the possession or under the control of a department (except for cabinet confidences) and to receive from the department any documents and explanations NSIRA deems necessary. NSIRA monitors cooperation with access requests, including the completeness and accuracy of disclosures, which inform its overall assessment of a department’s responsiveness in each review.

All reviewees met NSIRA’s expectations for responsiveness during this review.

2. Background

The SCIDA provides an explicit, stand-alone authority to disclose information between GC institutions in order to protect Canada against activities that undermine its security. Its stated purpose is to encourage and facilitate such disclosures.

Section 9 of the SCIDA prescribes record-keeping obligations for all institutions who disclose or receive information under the Act. Subsection 9(3) requires that these records be provided to NSIRA within 30 days after the end of each calendar year.

Subsection 5(1) of the SCIDA authorizes GC institutions to disclose information –subject to any prohibitions or restrictions in other legislation or regulations – to designated recipient institutions if the disclosing institution is satisfied that (a) the information will contribute to the exercise of the recipient institution’s jurisdiction or responsibilities in respect of activities that undermine the security of Canada (the “contribution test”); and (b) the information will not affect any person’s privacy interest more than is reasonably necessary in the circumstances (the “proportionality test”).

Subsection 5(2) requires disclosing institutions to, at the time of the disclosure,also provide information regarding the disclosure’s accuracy and the reliability ofthe manner in which it was obtained.

When a GC institution receives information under the Act, subsection 5.1(1)requires that the institution destroy or return any unnecessary personal informationas soon as feasible after receiving it.

The SCIDA’s guiding principles reinforce the notion that effective and responsible disclosure of information protects Canada and Canadians. Of note, subsection 4(c)suggests that GC institutions enter into an information-sharing arrangement when they regularly disclose information to the same recipient.

3. Findings, Analysis, and recommendations

Volume and Nature of Disclosures

In 2023, GC institutions made a total of 269 disclosures under the SCIDA (see Table 1).

Table 1: Number of SCIDA disclosures made in 2023, by disclosing and recipient institution [all disclosures (proactive disclosures)]

		Designated Recipient Institutions
Disclosing Institution		CBSA	CFIA	CNSC	CRA	CSE	CSIS	DND/CAF	Finance	FINTRAC	GAC	Health	IRCC	PHAC	PSC	RCMP	TC	TOTAL (proactive)
	CBSA	–	–	–	–	–	–	–	–	–	–	–	–	–	–	2 (2)	–	2 (2)
	GAC	–	–	–	–	1 (1)	10 (0)	–	–	–	–	–	–	4 (0)	–	15 (1)	–	53 (32)
	IRCC	–	–	–	–	58 (0)	194 (7)	–	–	–	–	–	–	–	–	–	–	252 (7)
	TOTAL (proactive)	–	–	–	–	59 (1)	204 (7)	–	–	–	–	–	1 (0)	–	–	6 (2)	–	263 (10)

The number of disclosures increased 55% since 2022, reversing the slight downward trend in the number of disclosures observed across prior years. This shift is largely due to a 246% increase in disclosures from IRCC to CSIS. CSIS attributes this increase to a policy shift that led them to use the SCIDA to request information that IRCC previously provided under the Privacy Act.

As in previous years, disclosing institutions made the vast majority of disclosures following a request. Only 4% of disclosures were sent proactively by the disclosing institution.

Record Keeping Requirements – Section 9

Finding 1. NSIRA found that every institution that disclosed or received information pursuant to SCIDA in 2023 complied with their record keeping obligations under section 9, but some records were inaccurate or imprecise.

Section 9 of the SCIDA prescribes record-keeping obligations for all disclosing institutions, as well as institutions who receive information pursuant to a disclosure. These requirements include, among others, that records of the disclosure describe the information as well as indicate whether the information was destroyed or retained by the recipient. NSIRA’s cross-reference of records provided by disclosing and recipient institutions revealed some inaccuracies that were clarified through discussion with the institutions following receipt of their records:

Under paragraph 9(2)(a), CSE mislabelled the number of subjects that the disclosure pertained to in four (of 59) instances;

Under paragraph 9(2)(e), CSIS records included contradictory information as to whether the information received has been destroyed or retained; and

Under paragraph 9(1)(a), IRCC records included contradictory descriptions of the information disclosed.

NSIRA was unable to reconcile the information provided in relation to one case where the CBSA made a verbal disclosure to the RCMP. Based on the initial records provided by the RCMP and CBSA, NSIRA could not determine with certainty what personal information was shared, and when. In response to a recommendation from NSIRA’s SCIDA review for 2022, the CBSA developed a record of disclosure form to serve as a record overview. In this instance, the form was incomplete and contradicted the copy of the disclosure that was also provided to NSIRA.

As it did last year, NSIRA underscores the importance of administrative precision in preparing records, and notes that a record overview – when correctly prepared –supports compliance with SCIDA record keeping requirements.

NSIRA identified several instances in which the disclosing institution did not provide an explicit statement, under paragraph 9(1)(e), regarding the information that was relied on to satisfy the disclosing institution of the proportionality test. Three of these disclosures were included in NSIRA’s targeted sample for assessing the contribution and proportionality tests.

Contribution and Proportionality Tests – Subsection 5(1)

Finding 2. NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves under the contribution and proportionality tests in compliance with subsection 5(1) of the SCIDA.

To assess compliance with subsection 5(1), NSIRA first considered the explicit statements prepared by disclosing institutions under paragraph 9(1)(e), describing the information that was relied on to satisfy themselves that the disclosure was authorized under the Act. When an explicit statement was provided, NSIRA analysed and corroborated these statements by reviewing all other documents provided by GC institutions related to a given disclosure. Additional documents provided did not raise any concern with paragraphs 5(1)(a) and 5(1)(b) compliance.

For all 27 disclosures included in the sample, the disclosing institution provided anexplicit statement that demonstrated that they had satisfied themselves that thedisclosure would contribute to the recipient’s jurisdiction or its responsibilities.24.

For 24 of the 27 disclosures, the disclosing institution provided an explicit statement that demonstrated they had satisfied themselves that no one’s privacy would be affected more than reasonably necessary in the circumstances. In the remaining three disclosures, despite having no explicit statement, other documents provided by the disclosing institutions nevertheless demonstrated that they had satisfied themselves of the proportionality test.25.

While NSIRA found that institutions were generally compliant with paragraphs5(1)(a) and 5(1)(b), IRCC’s contribution and proportionality assessments demonstrated some deficiencies. These deficiencies form the basis of findings 3and 4.

Recommendation 1. NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.

SCIDA’s Exception for Advocacy, Protest, or Dissent

Finding 3. NSIRA found that IRCC did not, in one instance, independently consider whether its disclosure related to activities that fell under the SCIDA exception for advocacy, protest, or dissent. Instead, IRCC satisfied itself of the SCIDA’s contribution test based on assumptions about how CSIS assessed activities that undermine the security of Canada.

The contribution test under paragraph 5(1)(a) requires the disclosing institution to assess whether the disclosure relates to activities that undermine the security of Canada. These activities are defined by the Act and include, for example, espionage, covert foreign-influenced activities, terrorism, and significant or widespread interference with critical infrastructure. In its definition of activities that undermine the security of Canada, subsection 2(2) of the SCIDA includes an exception for advocacy, protest, dissent, or artistic expression. These, in and of themselves, do not constitute activities that undermine the security of Canada. The legislated exception helps to distinguish between legitimate forms of political dissent and national security threats.

In one instance, CSIS requested detailed information from IRCC related to an individual. The request sought current and past passport applications and these contain a great deal of personal information3.CSIS justified its request with anexcerpt from a news article which cited a quote uttered publicly by the individualduring a protest.

IRCC did not request any additional rationale from CSIS. It disclosed the individual’s passport application, including some associate’s information, along with the individual’s passport number, place of issue, and dates of issue and expiry.

In response to a query from NSIRA regarding on what basis it satisfied itself of the contribution test, IRCC explained that it “relies on the partner to accurately describe that the individual is tied to an activity that may undermine the security of Canada.” The IRCC official who authorized the disclosure further explained that IRCC assumed that CSIS had not relied solely on the individual’s statements quoted in the news article given the limits of CSIS’s authority to investigate lawful advocacy, protest or dissent under the CSIS Act.

The CSIS Act includes an exemption preventing CSIS from investigating lawful advocacy, protest or dissent, without the presence of threat related activities itemised in the CSIS Act. However, the SCIDA’s use of “activity that undermines the security of Canada” is a purposeful departure from the CSIS Act’s “threat to the security of Canada”. The distinction reflects legislative intent that the disclosing institution perform its own, fit-for-purpose assessment.

Subsection 5(1) of the SCIDA explicitly places the onus on the disclosing entity to assure itself that the disclosure is authorized. The process by which an institution satisfies itself should be grounded in an independent and factual assessment. In that context, a mere acquiesce of a request would not be sufficient, nor would a de facto reliance on the recipient respecting their enabling legislation. The threshold of satisfaction imports an objective standard that must be based on facts.

PS guidance notes that although the threshold imposed by subsection 5(1) does not hold institutions to perfection, they must make all reasonable efforts to satisfy themselves that the information will contribute to the recipient’s national security mandate. When encountering activities occurring in the context of political dissent or a protest, NSIRA expects institutions with a national security mandate to exercise caution when requesting information relating to an activity protected under the Canadian Charter of Rights and Freedoms (Charter) to further an investigation. At the same time, in this case, IRCC should have obtained more information prior to disclosure, to substantiate what activities were undermining the security of Canada to ensure the exception did not apply.

Recommendation 2. NSIRA recommends that IRCC amend their SCIDA policy to underscore that IRCC must independently assess whether the disclosure is authorized. This assessment should consider whether the activity amounts to one of the exceptions to the SCIDA’s definition of activities that undermine the security of Canada.

IRCC’s New Approach to Proportionality Assessments

Finding 4. NSIRA found that, throughout the course of 2023, IRCC improved the rigour of its proportionality assessments regarding disclosure of passport information. However, NSIRA identified three instances where IRCC disclosed visa information without applying the same rigorous approach, which risked disclosing more personal information than reasonably necessary in the circumstances.

In summer 2023, IRCC adopted a “higher” standard to satisfy itself that no person’s privacy interest would be affected more than reasonably necessary when disclosing passport information to CSIS. According to IRCC, this shift was prompted by a previous NSIRA recommendation that IRCC be explicit in their records that the proportionality test was met. Not only did IRCC adjust their record keeping practices, but they also turned their attention to the substantive issue at hand. Indeed, IRCC closely examined the privacy impact their disclosures may have when responding to CSIS requests.

As a result, when dealing with the absence of additional rationale from CSIS, IRCC became more conservative in the disclosure of information. For example, IRCC began redacting associate’s information in passport applications, limiting the provision of historical applications, and refraining from disclosing applications of minors. They adopted an iterative approach to disclosing passport information, which cultivated a more appropriate weighting of individuals’ privacy interests vis-à-vis the recipient’s investigative needs.

IRCC’s new approach to assessing the proportionality of passport information disclosures was not well-received by CSIS, who characterize their receipt of redacted passport applications as a “massive” hindrance to section 12 investigations. In internal correspondence, a CSIS analyst noted that they would prefer that “IRCC not filter down the info and let them [CSIS] make the assessment based on the knowledge of [national security] threats”.

Still, the discretionary nature of SCIDA disclosures make it such that IRCC may choose what information to disclose, if any. IRCC’s SCIDA Standard Operating Procedure states that requests for disclosure must provide sufficient information to justify the release of associate’s information. Under the SCIDA, it is entirely within IRCC’s purview to seek and obtain such justification prior to disclosing information.

IRCC’s increased attention to privacy interests in the context of passport application disclosures was not imparted to disclosures of information collected from visa applications. It is important to note that this distinction is not a factor that should be considered when assessing proportionality. Under the SCIDA, the privacy interests of citizens and non-citizens must be similarly assessed, and only treated differently in a visa application if no reasonable expectation of privacy is assessed.

Annex B presents the details of three disclosures in relation to which IRCC disclosed visa information to CSIS, concerning over 20 individuals, without having first established facts relevant to the conduct of an informed proportionality assessment. In these cases, either the identities of the subject of the request were unknown or the link between the subject of the disclosure and the threat had yet to be established. NSIRA would have expected IRCC to follow a more iterative approach to disclosing this information, consistent with its approach to passport disclosures in the later part of 2023. Such an iterative approach would have entailed disclosing only basic information until a greater connection to the activity that undermined the security of Canada could be established or the identity of the individual could be confirmed.

Additionally, the cases presented in Annex B are not fully consistent with IRCC policy, which underscores that “disclosing […] more personal information than is necessary could constitute a breach of a person’s reasonable expectation of privacy, a right protected by the Canadian Charter of Rights and Freedoms”. This is an important consideration since the proportionality of a given disclosure may be a factor in determining its Charter reasonableness.

Under the SCIDA regime, and as explained in PS guidance, the proportionality testis conducted to help determine the scope of what can be disclosed, and not necessarily whether the disclosure should occur. Thus, it would have been warranted for IRCC to assess how the sharing of each piece of information would impact the privacy of the individuals in question.

Recommendation 3. NSIRA recommends that IRCC apply an iterative approach to its proportionality assessments, with a view to disclosing only the minimum information reasonably necessary in the circumstances to enable the recipient institution to further their investigation.

CSIS Request Letters

Finding 5. NSIRA found that CSIS requests to IRCC used inconsistent terminology and were often unclear about the relationship between the subject of the request and its investigation. At times, this lack of clear communication hindered IRCC’s efforts to satisfy itself that the disclosure was authorised under the SCIDA.

96% of IRCC disclosures to CSIS were in response to a request. IRCC used the information in CSIS’s request letters to assure itself that a disclosure met both the contribution and the proportionality tests. While IRCC is always at liberty to request more information from CSIS to satisfy itself that the disclosure is authorized, in the majority of disclosures requested by CSIS, IRCC based its assessments solely on the information provided by CSIS in the request letter.

NSIRA reviewed all request letters sent by CSIS to IRCC. CSIS used a wide variety of terms to describe the nature of its interest in the subject of a request, such as:

The subject came to the attention of the Service
The subject is of interest for possible involvement in
The subject is of interest in connection with
The subject is believed to be an associate of a target
The subject is related to the threat
The individual is the subject of a Service investigation
The subject is part of a Service investigation
The subject is very closely associated to a CSIS subject of investigation

In most cases, CSIS did not define these terms or provide any more information on why the subject was of interest.

Furthermore, CSIS used the same (or similar) words when referring to different levels of interest. For example, “associated with” and “part of a Service Investigation” were used in requests for individuals with no known involvement in threat related activities and for individuals who CSIS has reason to suspect are involved in threat activities. In another instance, CSIS’s request letter stated that the subjects were related to the threat, but the connection between the threat and the individuals had not been established.

As a result of these inconsistencies and lack of clarity, IRCC could not understand key nuances relevant to its proportionality assessments. This issue is compounded by the fact the CSIS tended to request “any and all information” associated with the subject(s) of a request.

The relationship between the information requested and an investigation is an important factor considered by IRCC when assessing proportionality. Indeed, IRCC’s new approach to assessing proportionality takes into consideration the fact that information on associates contained in passport applications may not be material to the investigation. As a result, IRCC has often opted to redact some associate’s information, unless CSIS provided some indication that they are, or could be, implicated in the threat activity. In one of the several instances where CSIS stated that the subject of the request was “very closely associated to a CSIS subject of investigation”, IRCC requested an explanation to clearly link the subject of the request to the investigation. When CSIS did not provide it, IRCC opted to cancel the disclosure as it was not satisfied that the disclosure would meet the proportionality test.

It is essential that CSIS convey information in a clear and consistent manner given that IRCC takes this information into account in conducting its proportionality assessments. This is especially true when IRCC is disclosing associate’s information. When requesting information under the SCIDA, recipient institutions should, as a matter of course, facilitate disclosing institutions’ compliance with SCIDA thresholds by using clear and consistent terminology.

In late 2023, CSIS began centralizing its process for requesting IRCC SCIDA disclosures and developed a standard request form, which should help with consistency. As no requests were made in 2023 using these standard forms, NSIRA could not assess the effect of these changes in practice.

Recommendation 4. NSIRA recommends that CSIS use consistent terminology, and be clear about the nature of the link that has been established between the subject of a request and its investigation, to assist IRCC in satisfying itself of the proportionality test.

Reliability and Accuracy Statement – Subsection 5(2)

Finding 6. NSIRA found that disclosing institutions provided information regarding the accuracy of the information and reliability of the manner in which it was obtained in relation to all disclosures. However, CBSA made one verbal disclosure that did not include an explicit statement on accuracy and reliability.

Under the SCIDA, departments are required to provide information on the accuracy and the reliability of the manner in which the information being disclosed was obtained. They must do so at the time of the disclosure.

All written disclosures made in 2023 contained a statement on accuracy and reliability. However, CBSA made one proactive verbal disclosure of a tip to the RCMP, previously described in paragraph 19, in which it did not provide an explicit statement regarding accuracy and reliability at the time of disclosure.

Although the same information was shared again in writing two weeks later, an explicit, written statement on accuracy and reliability was only shared with the RCMP nearly two months later, when the CBSA disclosed additional information about the subject.

Subsection 5(2) states that “information” regarding accuracy and reliability “must” be provided at time of disclosure. NSIRA assesses in this case that, by its very nature, relaying that the information disclosed was derived from a tip conveyed information regarding accuracy and reliability to the RCMP. That said, an explicit, written statement is considered best practice. While verbal disclosures are not prohibited by the SCIDA, PS guidance notes that “[i]nformal communication cannot be used in lieu of the formal disclosure process or to replace the formal recordkeeping obligations.”

Recommendation 5. NSIRA recommends that institutions avoid making verbal disclosures whenever possible. When they must occur, verbal disclosures should explicitly convey the requisite information on accuracy and reliability.

Finding 7. NSIRA found that CBSA’s record of disclosure form contradicts the SCIDA by allowing officials to opt out of providing information regarding accuracy and reliability.

Although CBSA policy correctly reflects the mandatory nature of providinginformation on accuracy and reliability, its new record of disclosure form does not.The form includes a yes/no checkbox to indicate whether a statement confirmingthe accuracy and reliability was provided to the recipient institution. If the CBSAofficial selects “no”, they are prompted to explain why they elected to not provide astatement. This implies that it is discretionary and leaves the opportunity for CBSAto opt out of the requirement.

Further, the form does not specify that the statement must be provided at the timeof disclosure, as the SCIDA specifically demands.

Recommendation 6. NSIRA recommends that CBSA harmonize its record of disclosure form with the SCIDA to convey the mandatory nature of providing information on accuracy and reliability at the time of the disclosure.

Finding 8. NSIRA found that IRCC used templated language to describe the disclosure’s accuracy and reliability that was not always relevant or specific to the circumstances of the disclosure.

All IRCC disclosures made in 2023 included the same accuracy and reliability statement:

The information in this disclosure was provided by the Subject as part of their various applications to IRCC. The Subject declared that the information they provided as part of their applications was truthful, complete and correct. The information in this disclosure is accurate and reliable in so far as the Subject was truthful in their submissions to our Department. IRCC holds no information that would call into question the accuracy and reliability of the information provided by the Subject.

There are several cases where this statement provided by IRCC did not reflect the specific circumstances of the disclosure. For example, the statement above was included in a disclosure where no immigration or passport records were found and the only information disclosed was the lack of records. The same statement was used in disclosures of child general passport applications, which are actually completed by parents or legal guardians rather than by the subject themselves. When solely disclosing citizenship status to CSE, IRCC still included the same statement, despite the information disclosed not being provided by the subject as part of their application. In one case, the IRCC used the same statement in the disclosure but nevertheless contradicted itself by also stating that there was some reason to believe the information might not be accurate.

All of these cases point to a tendency of copying the accuracy and reliability information without giving sufficient attention to the relevance of the statement.

When instructing on the accuracy and reliability statement, the PS SCIDA guide suggests that “formulaic (templated) language should be avoided, unless the nature and source of information disclosed is derived from a routine process.” IRCC produces a large number of disclosures every year. While some language can be recycled, it is necessary that the statement remain an accurate representation of each disclosure. NSIRA has previously recommended that statements be clear and specific to the circumstances of the disclosure.

Recommendation 7. NSIRA recommends that IRCC tailor its statements on accuracy and reliability as to ensure that each disclosure’s statement is specific to the circumstances of the case.

Information Sharing Agreement – Subsection 4(c)

Finding 9. NSIRA found that disclosures between IRCC and CSE that occurred following the enactment of their new information sharing agreement were compliant with both the SCIDA and their information sharing agreement.

In past SCIDA reviews, NSIRA noted that some departments regularly use the SCIDA in a manner that warrants information sharing arrangements (ISA), as encouraged by subsection 4(c) of SCIDA. In 2022, NSIRA recommended that IRCC and CSE develop an ISA to govern their SCIDA disclosures.

In August 2023, IRCC and CSE signed an ISA. As a whole, the new ISA between IRCC and CSE supports compliance with SCIDA, with all key legislated requirements from SCIDA being included in the ISA. The agreement also adheres to the guidance on preparing ISAs recently developed by PS.

Of the 24 disclosures made after the ISA implementation, all were deemed compliant with the new agreement. NSIRA looked at each disclosure made under the ISA and assessed them against a majority of the requirements outlined in the agreement.

4. Conclusion

This review assessed GC institutions’ compliance with requirements for recordkeeping in respect of all 269 disclosures that were made and received in 2023. It assessed their compliance with requirements for disclosure in relation to a targeted sample of 27 disclosures. All were compliant with SCIDA requirements, but NSIRA found that IRCC’s contribution and proportionality assessments demonstrated some deficiencies. An increased understanding of the activities that undermine the security of Canada would support a more thorough proportionality assessment and greater utility of the disclosed information.

NSIRA made recommendations aimed at promoting compliance with SCIDA, particularly with regard to how departments determine whether the contribution and proportionality tests have been met.

Annex A. Sample of Disclosures

Disclosures were selected for the sample based on the content of records provided to NSIRA under subsection 9(3), according to the following parameters:

At least two disclosures per discloser-recipient pair, if available;
At least one proactive disclosure per discloser, if available;
At least one requested disclosure per recipient, if available;
All disclosures identified by recipient institutions as including personal information that was destroyed or returned under the SCIDA, subsection5.1(1);
All disclosures for which there is a high-level discrepancy in the discloser and recipient records;
All disclosures made by an institution that is not listed in Schedule 3 of the SCIDA;
All disclosures received by institutions added to Schedule 3 in the preceding year; and
All disclosures that, based on the review team’s preliminary assessment, present a heightened risk of non-compliance under section 5.

Annex B. Cases Relating to IRCC’s Disclosure of Visa Information

Disclosure 1 (Economic Security Threat)

IRCC proactively disclosed to CSIS the visa applications of several individuals who received a work permit in various research fields linked to economic security threat. These applications included personal information such as employment history, travel history, contact information, photos, passport information, and associate’s information. This was part of IRCC’s effort to proactively identify and share with CSIS information about individuals that may engage in activities that pose a threat to Canada’s economic prosperity.

While the national security concern posed by these types of economic security threats is well documented, the role that these individuals played in that space was unknown. IRCC selected the individuals in question based on one threat related criteria, but the other criteria used to narrow the pool individuals from several hundreds to a few individuals were unrelated to the threat the individuals posed. Indeed, IRCC chose these additional arbitrary criteria mainly for practical reasons.

For greater clarity, there was no information indicating that any of the several individuals in question were involved in activities that undermine the security of Canada. Most of these applications were not initially referred to CSIS for security screening by IRCC, meaning that the visa officer was fully satisfied that the applicants posed no threat. In one case, the application was sent for security screening but CSIS returned a favorable recommendation and the individual was granted a visa.

The proactive sharing of complete visa application packages with CSIS risked affecting these individuals’ privacy more than was reasonably necessary in the circumstances.

Disclosure 2 (Foreign Entity)

CSIS requested passport information about any individuals with a valid visa currently working for a specific foreign entity. IRCC did not have any passport applications for the individuals that matched the search criteria, but nevertheless disclosed entire visa applications for some individuals. IRCC also provided information about individuals who had previously worked at the foreign entity, and individuals who did not have a valid visa. This misalignment between what was requested and what was disclosed does not reflect a proper tailoring of information to meet SCIDA’s contribution and proportionality tests.

None of these individuals had been linked to a specific activity that undermined the security of Canada, either at the time of the request nor following the disclosure. CSIS and IRCC’s inability to characterize the nature of the individuals’ relationship to threat activities created a risk that IRCC’s disclosure may have affected their privacy more than was reasonably necessary in the circumstances.

Disclosure 3 (Bulk Data)

CSIS sent a letter to IRCC requesting the disclosure of information within immigration applications on individuals including a spreadsheet with certain identifying personal information (called “selectors”). While large data-set requests and disclosures are not prohibited by the SCIDA, the requirements imposed by the contribution and proportionality tests must be applied to every discrete piece of information disclosed. As such, this type of information would need to be responsibly assessed prior to disclosure.

While the CSIS request letter provides extensive rationale as to why the threat actor named in the request letter poses a threat to national security, the IRCC officials that authorized the disclosure did not have contemporaneous information on how these selectors, and, by extension the individuals linked to these selectors, are linked to the threat actor.

Nevertheless, IRCC disclosed significant personal details pertaining to several individuals. For example, the disclosure included a foreign state visa refusal, information about military service, a personal picture, and other documents that would have been provided as part of a visa application.

This disclosure included more information than what CSIS requested. Given that the identity of the individuals are unconfirmed, as CSIS’s request clearly stated that the purpose of this request was for identification, this suggests that IRCC risked disclosing more than the least amount of personal information necessary for CSIS to further its investigation.

While the legislative burden to ensure that the disclosure is authorized under SCIDA falls on the disclosing entity, in this case IRCC, it may be very complex fora disclosing entity to discharge its obligation under paragraphs 5(1)(a) and 5(1)(b)with these types of large data-sets requests, particularly when the requester provides very little rationale linking each selector or individual to the activity that undermines the security of Canada.

Annex C. Overview of SCIDA Disclosures in Prior Years

Disclosing Institution	Designated Recipient Institutions under the SCIDA, Schedule 3
Disclosing Institution	CBSA	GAC	CNSC	CRA	CSE	CSIS	DND/CAF	Finance	FINTRAC	GAC	Health	IRCC	PHAC	PS	RCMP	TC	TOTAL
2022
CBSA	–	–	–	–	–	–	–	–	–	–	–	–	–	–	4	–	4
GAC	–	39	2	–	–	–	–	–	–	–	–	–	–	–	12	–	53
IRCC	–	59	56	–	–	–	–	–	–	–	–	–	–	–	–	–	115
RCMP	–	–	–	–	–	–	–	–	–	–	–	–	–	–	1	–	1
TOTAL	–	59	95	2	–	–	–	–	–	–	–	–	–	–	16	–	173
2021
DND/CAF	–	–	–	–	–	–	–	–	–	–	2	–	–	–	–	–	2
GAC	–	–	–	–	–	–	–	–	–	–	–	–	–	–	2	–	44
IRCC	–	68	79	–	–	–	–	–	–	–	–	2	–	1	–	–	149
TOTAL	–	68	122	–	–	–	2	–	–	–	–	2	–	1	2	–	195
2020
CBSA	–	–	–	–	–	–	–	–	–	–	1	–	–	–	–	–	4
GAC	–	–	–	–	–	–	–	–	–	–	–	–	25	–	–	13	40
IRCC	–	60	61	–	–	–	–	–	–	–	–	–	1	–	37	–	159
RCMP	–	–	1	–	–	–	–	–	–	–	–	1	–	–	–	–	3
TC	–	–	–	–	–	–	–	–	–	–	–	–	–	–	–	2	2
Other¹⁰	–	–	–	–	–	–	–	–	–	–	–	–	–	–	–	–	1
TOTAL	–	61	88	1	–	–	3	–	–	–	–	6	–	55	1	–	215
2019
CBSA	–	–	–	–	–	–	–	–	–	–	–	–	–	–	1	–	3
GAC	–	–	–	–	–	–	–	–	–	–	–	–	23	–	–	–	42
IRCC	–	5	17	–	–	–	–	–	–	–	–	–	1	–	36	–	59
RCMP	–	4	1	–	–	–	–	–	–	–	–	–	–	3	–	–	8
TC	–	–	–	–	–	–	–	–	–	–	–	–	–	–	1	–	2
TOTAL	–	4	5	–	41	–	1	–	–	–	1	–	–	–	–	–	114

Annex D. Findings and Recommendations

Record Keeping Requirements – Section 9

Finding 1. NSIRA found that every institution that disclosed or received information pursuant to SCIDA in 2023 complied with their record keeping obligations under section 9, but some records were inaccurate or imprecise.

Contribution and Proportionality Tests – Subsection 5(1)

Finding 2. NSIRA found, within the sample of disclosures reviewed, that disclosing institutions demonstrated they had satisfied themselves under the contribution and proportionality tests in compliance with subsection 5(1) of the SCIDA.

Recommendation 1. NSIRA recommends that disclosing institutions explicitly address the requirements of both paragraphs 5(1)(a) and 5(1)(b) in the records that they prepare under paragraph 9(1)(e) of the SCIDA.

Finding 3. NSIRA found that IRCC did not, in one instance, independently consider whether its disclosure related to activities that fell under the SCIDA exception for advocacy, protest, or dissent. Instead, IRCC satisfied itself of the SCIDA’s contribution test based on assumptions about how CSIS assessed activities that undermine the security of Canada.

Recommendation 2. NSIRA recommends that IRCC amend their SCIDA policy to underscore that IRCC must independently assess whether the disclosure is authorized. This assessment should consider whether the activity amounts to one of the exceptions to the SCIDA’s definition of activities that undermine the security of Canada.

Recommendation 3. NSIRA recommends that IRCC apply an iterative approach to its proportionality assessments, with a view to disclosing only the minimum information reasonably necessary in the circumstances to enable the recipient institution to further their investigation.

Finding 5. NSIRA found that CSIS requests to IRCC used inconsistent terminology and were often unclear about the relationship between the subject of the request and its investigation. At times, this lack of clear communication hindered IRCC’s efforts to satisfy itself that the disclosure was authorised under the SCIDA.

Recommendation 4. NSIRA recommends that CSIS use consistent terminology, and be clear about the nature of the link that has been established between the subject of a request and its investigation, to assist IRCC in satisfying itself of the proportionality test.

Reliability and Accuracy Statement – Subsection 5(2)

Finding 6. NSIRA found that disclosing institutions provided information regarding the accuracy of the information and reliability of the manner in which it was obtained in relation to all disclosures. However, CBSA made one verbal disclosure that did not include an explicit statement on accuracy and reliability.

Recommendation 5. NSIRA recommends that institutions avoid making verbal disclosures whenever possible. When they must occur, verbal disclosures should explicitly convey the requisite information on accuracy and reliability.

Finding 7. NSIRA found that CBSA’s record of disclosure form contradicts the SCIDA by allowing officials to opt out of providing information regarding accuracy and reliability.

Recommendation 6. NSIRA recommends that CBSA harmonize its record of disclosure form with the SCIDA, to convey the mandatory nature of providing information on accuracy and reliability at the time of the disclosure.

Finding 8. NSIRA found that IRCC used templated language to describe the disclosure’s accuracy and reliability that was not always relevant or specific to the circumstances of the disclosure.

Recommendation 7. NSIRA recommends that IRCC tailor its statements on accuracy and reliability as to ensure that each disclosure’s statement is specific to the circumstances of the case.

Information Sharing Agreement – Subsection 4(c)

Finding 9. NSIRA found that disclosures between IRCC and CSE that occurred following the enactment of their new information sharing agreement were compliant with both the SCIDA and their information sharing agreement.

Date Modified:: 2025-06-13

Public Safety and Canadian Security Intelligence Service Accountability Mechanisms: Backgrounder

Public Safety and Canadian Security Intelligence Service Accountability Mechanisms

Backgrounder

In September 2022, the then-Minister of Public Safety, the Honourable Marco Mendicino, requested the National Security and Intelligence Review Agency (NSIRA) to conduct a review—known as a referral— to examine whether the Canadian Security Intelligence Service (CSIS) and the Department of Public Safety (PS) were effectively supporting Ministerial responsibility.

This review focused on three key areas: CSIS’s risk assessment model, Ministerial Direction, and the mechanisms for sharing information with the Minister.

The referral revisited a long-standing question about the proper level of Ministerial oversight over an intelligence agency. This issue was central to the McDonald Commission of Inquiry in the early 1980s, which investigated misconduct by the RCMP Security Service and ultimately led to the creation of CSIS. The Commission concluded that while a Minister should not manage the “day-to-day operations” of an intelligence agency, the Minister must retain the right to provide direction—so long as it complies with the law. The Commission rejected the idea that the intelligence service should operate like the police, who have more operational independence. Instead, it took the position that while intelligence agencies must be protected from political interference, the answer isn’t to reduce government oversight. Rather, a comprehensive system of specialized review should be in place to ensure intelligence work remains accountable and operates within the law.

NSIRA accepted the referral for two main reasons. First, the Minister’s questions raised important concerns about whether Ministers are adequately equipped to provide informed oversight—a core principle of democratic governance. Second, the circumstances were unusual: unlike typical operational matters involving only the Minister and CSIS, this case involved senior political-level actors from across the Government of Canada. Although operational details remain classified, NSIRA found that directions from these broader interventions introduced unnecessary risks to CSIS operations and harmed Canada’s international reputation. The report refers to these actors as “political-level actors/decision.”

NSIRA’s review identified several significant concerns, including the appropriateness of direction given to CSIS by political-level actors outside the Minister of Public Safety or the CSIS Director, contrary to the CSIS Act; the accuracy and timeliness of information that CSIS and the Department of Public Safety provide to the Minister; the clarity and consistent implementation of Ministerial Direction to CSIS; and the effectiveness of CSIS’s risk assessment processes.

A key contributor to these issues is PS’s reliance on CSIS to identify and share relevant information, which limits the department’s ability to independently support the Minister with a full understanding of CSIS activities.

These findings suggest the Minister of Public Safety may not always receive full and timely support when making decisions about CSIS. This gap poses risks to the effectiveness of democratic oversight and proper Ministerial responsibility.

To address these challenges, NSIRA’s report made six recommendations focused on improving information-sharing within government, strengthening accountability mechanisms, and clarifying lawful and effective Ministerial Direction.

Date Modified:: 2025-05-29

Public Safety and Canadian Security Intelligence Service Accountability Mechanisms: Report

Public Safety and Canadian Security Intelligence Service Accountability Mechanisms

Report

Table of Contents

Executive Summary
List of Acronyms
Introduction
Background
1. The Referral – Did the Minister have the necessary Information?
2. The Source, the Operation, and the Halt [**redacted**]
Findings, Analysis, and Recommendations
CSIS’s Risk Assessment Process
Conclusion
Annex A. [**redacted**] – A Case Study
1. Background
Annex B. Role of Minister
ANNEX C. Findings and Recommendations

Date of Publishing:

May 27, 2025

Download PDF

Executive Summary

This review stems from a September 2022 referral by the former Minister of Public Safety (PS). The Minister requested that NSIRA evaluate whether the Canadian Security Intelligence Service’s (CSIS or the Service) risk assessment model, Ministerial Direction (MD) and other information sharing mechanisms enable the Minister to effectively [participation in…] discharge their responsibilities for CSIS. Ministerial concerns about the adequacy of such mechanisms arose from CSIS’s [**redacted**] an operation which prompted considerable deliberation within Canada’s national security community and direct intervention by [**redacted**].

Of the four current MDs to CSIS, three are relevant to accountability for operations: Threats to the Security of Canada Directed at Parliament and Parliamentarians (2023); Operations (2023); and Accountability (2019). Responding to the Minister’s referral, NSIRA examined CSIS’s implementation of these MDs, including its establishment of an interdepartmental consultative process to engage Public Safety Canada (PS), Global Affairs Canada (GAC) and the Department of Justice (DOJ) in assessing the reputational, foreign policy and legal risks of the Service’s proposed operations. NSIRA also decided to review the aforementioned CSIS [**redacted**] operation.

NSIRA found that the decision to halt this active CSIS operation [**redacted**] was not made by the CSIS Director under section 6(1) of the CSIS Act, and for which there is no written record of a direction coming from the Minister of Public Safety under sections 6(1) or 6(2) of the CSIS Act. Moreover, [**redacted**] to halt this active operation created unnecessary danger for the CSIS team [**redacted**] and caused harm to Canada’s international reputation.

While the Minister is accountable for CSIS activities, both PS and the Service must ensure their briefings to the Minister support this accountability. And on this point, the review found that PS and CSIS failed in their responsibility to provide timely and accurate information to the Minister about [**redacted**] human source [**redacted**] operation. NSIRA attributes these shortcomings to PS willingly remaining dependent on CSIS to identify and receive relevant information, which inhibits PS’s ability to prepare independent advice to the Minister about the activities and operations of CSIS.

NSIRA found that multiple MDs to CSIS are subject to inconsistent and contradictory interpretation by those responsible for their implementation. Moreover, NSIRA found that when preparing MDs to CSIS, PS insufficiently consulted with GAC and CSIS.

CSIS’s risk assessment process has evolved to become the central mechanism for planning operations and managing associated risks, and, while it is generally effective, it lacks clear guidance to employees on when risk should be reassessed as operations evolve. For foreign policy risk assessments, GAC and CSIS do not have a shared vision with respect to the role of GAC in this process.

NSIRA also found that legal advice is often absent from the final risk assessment record for CSIS operations. Moreover, the scope of legal considerations within these legal risk assessments is under-inclusive.

PS’s reliance on CSIS to identify relevant information is most plainly seen in the inadequacy of PS’s contribution on the preparation of reputational risk assessments. Although CSIS must retain management and control of its operational activities, this does not displace PS’s responsibility to ensure the Minister has all the information needed to make informed decisions and fulfill their accountability requirements. The [**redacted**] operation – which was exceptional but not novel – demonstrates the negative consequences of PS’s current approach.

In total, the review makes eleven findings which are addressed through six recommendations, which include that:

Whenever there is a decision affecting an active CSIS operation, which is not made by the Director of CSIS or their delegates, it must come as a direction from the Minister of Public Safety under section 6(1) of the CSIS Act and should be accompanied by a written record in keeping with section 6(2);
The Minister of Public Safety take action to ensure that the Deputy Ministerobtains any information required to fulfill their responsibility to provideindependent advice to the Minister about the activities and operations of CSIS;3.
The Minister of Public Safety consolidate ministerial directions into clear, concise and harmonized instruments that are derived from meaningful consultation among those responsible for their implementation;
CSIS, in consultation with DOJ and GAC, ensure that legal risk assessments are comprehensive and memorialized in writing;
Any pending changes to CSIS’s risk assessment process maintain a robust consultation and information sharing mechanism between GAC and CSIS; and,
PS and CSIS develop a more robust consultation mechanism for reputational risk assessment for CSIS operational activities, and that these assessments account for the risk of discrediting the Government of Canada.

List of Acronyms

CBSA: Canada Border Services Agency

CAF: Canadian Armed Forces

CSIS: Canadian Security Intelligence Service (or Service)

DDO: Deputy Director Operations

DM: Deputy Minister

DOJ: Department of Justice

GAC: Global Affairs Canada

GC: Government of Canada

IG: Inspector General of CSIS

MD: Ministerial Direction

NSIA: National Security and Intelligence Advisor to the Prime Minister

NSIRA: National Security and Intelligence Review Agency

ORA: Operational Risk Assessment

PCO: Privy Council Office

PS: Public Safety Canada

RCMP: Royal Canadian Mounted Police

SIRC: Security Intelligence Review Committee

AMC: Affaires mondiales Canada

ASFC: Agence des services frontaliers du Canada

BCP: Bureau du Conseil privé

CSARS: Comité de surveillance des activités de renseignement de sécurité

CSNR: Conseiller à la sécurité nationale et au renseignement auprès du premier ministre

ÉRO: Évaluation du risque opérationnel

FAC: Forces armées canadiennes

GC: Gouvernement du Canada

GRC: Gendarmerie royale du Canada

IGSCRS: Inspecteur général, Service canadien du renseignement de sécurité

IM: Instructions du ministre

MJ: Ministère de la Justice

OSSNR: Office de surveillance des activités en matière de renseignement et de sécurité

SCRS: Service canadien du renseignement de sécurité (le Service)

SDO: Sous-directeur des opérations

SM: Sous-ministre

SP: Sécurité publique Canada

Introduction

Authority

This review was conducted under the authority of paragraphs 8(1) (a), (b) and (c), and 8(2.1) (a) of the National Security and Intelligence Review Agency Act (NSIRA Act).

Scope of the Review

This review examined the Canadian Security Intelligence Service’s (CSIS or the Service) risk assessment model, Ministerial Direction (MD) and other information sharing mechanisms to determine if decision makers, including the Minister of Public Safety (PS), are provided with accurate and timely information. As part of this assessment, NSIRA examined the Service’s risk assessment consultations with Public Safety Canada (PS), Global Affairs Canada (GAC), and Department of Justice (DOJ). The Service’s [**redacted**] program was narrowly reviewed with respect to MD and risk and limited to the context of a specific CSIS [**redacted**] operation [**redacted**] to July 31, 2023.

Methodology

NSIRA had direct access to CSIS information holdings, remote portal access to GAC information, submitted 27 requests for information, attended 13 briefings and conducted 17 interviews. The information reviewed from the four departments included: relevant legislation, MDs, policies, procedures, [**redacted**] files, presentations, briefing notes, meeting summaries, legal advice and opinions, cooperation frameworks/mechanisms, and administrative and operational correspondence (e.g. memos, emails, and text messages).

For calendar year [**redacted**], NSIRA assessed over 50 ministerial memos and supporting documentation; [**redacted**] of these memos involved ‘high-risk ’notifications to the Minister of PS. NSIRA additionally examined approximately 100risk assessments from a variety of operational environments, including [**redacted**] risk assessments, as well as a number of operations within Canadian fundamental institutions (i.e. academia, trade unions, government and political institutions, and the media). Finally, NSIRA reviewed all of GAC’s [**redacted**] foreign policy risk assessments (i.e. [**redacted**] total, [**redacted**] assessed as high risk).

Review Statements

NSIRA found that its expectations for responsiveness by all reviewees during this review were met. NSIRA was satisfied by the proactive disclosure of relevant information by CSIS and GAC, and thanks employees from DOJ, PS and CSIS who volunteered to participate in NSIRA interviews.

NSIRA was able to verify information for this review in a manner that met expectations.

Background

The Referral – Did the Minister have the necessary Information?

This review stems from a referral to NSIRA by the former Minister of PS on September 15, 2022. The Minister asked NSIRA to evaluate whether the Service’s accountability mechanisms provide sufficient information to allow the Minister to effectively discharge their role as Minister responsible for CSIS. Concern on the adequacy of such mechanisms arose from [**redacted**] operation conducted by CSIS in [**redacted**] the circumstances surrounding this operation [**redacted**] led to extensive debate within Canada’s national security community and direct intervention by [**redacted**] and ultimately, was the catalyst for the referral to NSIRA.

In his letter, the Minister requested that NSIRA examine MD to CSIS, the Service’s risk assessment processes [**redacted**] program, as well as implementation of previous Security Intelligence Review Committee (SIRC) recommendations to CSIS, and whether any further changes were required. These questions informed NSIRA’s scoping of the review.

To appreciate the reasoning behind the Minister’s referral to NSIRA, it is first necessary to know the contextual underpinnings which led CSIS [**redacted**] as well as understand specific details about the operation. [**redacted**]

The Source, the Operation, and the Halt [redacted]

[**redacted**]

SIRC examined this case in detail [**redacted**] provided findings and recommendations aimed at addressing a number of interrelated issues, including legality of operations [**redacted**] MD, risk management, internal oversight, identity management, domestic and foreign partnerships, loss of operational environments and foreign strategic orientation. CSIS accepted all of SIRC’s recommendations, and these improvements were subject to additional review in subsequent years

The [**redacted**] story commences in [**redacted**] when CSIS first learned of [**redacted**] CSIS started working with domestic and foreign partners [**redacted**] operation [**redacted**] involving [**redacted**] CSIS [**redacted**]

[**redacted**] the Service informed both the Minister and PS [**redacted**] just over two weeks prior to the scheduled operation, [**redacted**] The Minister and PS raised no objections to proceed with the operation. Everything proceeded as planned, including [**redacted**] CSIS team [**redacted**]

[**redacted**] The ensuing debate resulted [**redacted**] to CSIS to halt- mid-operation [**redacted**] activities in [**redacted**] This decision needlessly placed [**redacted**] officers in danger and raises serious concerns regarding CSIS’s accountability mechanisms. Ultimately, the operation was allowed to proceed by [**redacted**] after a delay [**redacted**] The governance of this case will be examined throughout the analysis in this report.

Findings, Analysis, and Recommendations

Accountability and Consequences for Halting the [redacted] Operation

Finding 1. NSIRA found that a decision was made to halt an active CSIS operation overseas that was not made by the CSIS Director under section 6(1) of the CSIS Act, and for which there is no written record of a direction coming from the Minister of Public Safety under sections 6(1) or 6(2) of the CSIS Act.

Critical to the principle of responsible government is that ministers are accountableto Parliament for the actions of departments and agencies under their care. For theMinister of PS, this responsibility extends to exercising leadership at the nationallevel relating to public safety and for coordinating the activities of a portfolio whichincludes 66,000 employees and a $9 billion total annual budget for the RoyalCanadian Mounted Police (RCMP); CSIS; the Canada Border Services Agency(CBSA); the Canadian Firearms Centre; the Correctional Service of Canada; andthe Parole Board of Canada.

Given the size and scope of responsibilities for this portfolio, it would be impractical to presume that the Minister has knowledge of every issue. However, given that claims of ignorance are antithetical to the principle of responsible government, the Minister is accountable for every matter within the scope of their portfolio, whether or not they have knowledge of it. Most importantly, the Minister must take appropriate corrective action to address problems once informed of them by the public service, principally through the appropriate Deputy Minister (DM).

The Public Safety Act imposes broad national security responsibility on the Minister of PS. For example, section 4(2) provides that “the Minister is responsible for exercising leadership at the national level relating to public safety and emergency preparedness” and therefore, when considering the activities of CSIS, it is expected that the Minister will need to balance a wider set of interests in certain circumstances. This could include, for instance, whether the activity in question occurs in whole or in part outside of Canada, or if it engages the mandate of another Minister. This in turn requires that the DM of PS be sufficiently informed of all relevant information to advise and support the Minister.

Section 6(1) of the CSIS Act states that the Director, under the direction of the Minister, has the control and management of the Service. Approval [**redacted**] CSIS human source is made by the CSIS Deputy Director Operations, as per policy. In practice, the Minister has a more limited role with respect to these operations. For example, in addition to being notified of high-risk activities pursuant to MD, the Director’s classified annual report is also to inform the Minister of [**redacted**] human source [**redacted**].

The [**redacted**] to halt [**redacted**] raises questions about the web of accountability mechanisms that connect the Minister to CSIS. According to document review and NSIRA interviews, the direction to halt [**redacted**] operation occurring [**redacted**] was the result of [**redacted**] and first came from the National Security and Intelligence Advisor to the Prime Minister (NSIA) to the Director of CSIS. [**redacted**] team [**redacted**] meanwhile, was advised that “further to political-level direction,” the operation was “delayed”. Crucially, the CSIS team was not aware of when [**redacted**] activity would be permitted to resume, if at all.

The review revealed that CSIS senior officials had difficulty in grappling with [**redacted**] to halt the operation; so much so, in fact, that management and control of the operation appeared to cease functioning properly. The Director of CSIS, for instance, evidently no longer had decision making control over the active operation, when on [**redacted**] he sent an email to senior officials within key security and intelligence portfolios stating: “time is quickly running out, and the situation is getting much more tense on the ground. We need a decision tomorrow.”

Compounding the confusion was uncertainty as to who had authority to resume an active operation once [**redacted**] was involved. [**redacted**]

The CSIS Deputy Director approved the operation in writing [**redacted**] However, there is no written record that captures the decision to halt the operation [**redacted**] The same is the case for the decision to proceed with the operation [**redacted**] If the decision is not made by the CSIS Director or delegates, it must be the Minister who provides the appropriate direction. In law and by convention, the Minister will always be held accountable for the activities of CSIS, regardless of whether [**redacted**] has made the actual decisions directing these activities. While such memorialization is undertaken for routine Ministerial decision making, such as approving the submission of warrants, no system exists for exceptional circumstance [**redacted**].

Recommendation 1. NSIRA recommends that whenever there is a decision affecting an active CSIS operation, which is not made by the Director of CSIS or their delegates, it must come as a direction from the Minister of Public Safety under section 6(1) of the CSIS Act and should be accompanied by a written record in keeping with section 6(2).

Finding 2. NSIRA found that [**redacted**] halted an active operation, creating unnecessary danger for the CSIS team [**redacted**] and caused harm to Canada’s international reputation.

Regularized processes assist in reducing operational risks. When predictable decision-making practices become strained or are absent, individuals become increasingly prone to precipitous decisions, which can result in serious detrimental consequences. [**redacted**] operation drives home the necessity of thorough operational planning and comprehensive consultation to obtain required approvals and necessary support prior to operational execution.

[**redacted**] to halt an active sensitive CSIS operation [**redacted**] produced damaging. CSIS, [**redacted**] had accepted [**redacted**] in advance of the operation. [**redacted**] made clear that a failure to [**redacted**] would result in [**redacted**].

The CSIS [**redacted**] team also believed – reasonably in NSIRA’s view – that safety was in jeopardy. [**redacted**] perspective, the operational delay undermined confidence in the Service’s adherence [**redacted**]. The CSIS team told NSIRA that they felt abandoned [**redacted**], and they believed that the absence of a Government decision “was a decision” (i.e. the Government would allow [**redacted**] leaving no choice but [**redacted**]. Facing this untenable situation, the CSIS team felt forced to plan alternative actions to help ensure [**redacted**] their own, [**redacted**] safety.

As serious as the situation appeared to be [**redacted**] when the operation was halted, the stakes were raised further after the team of CSIS officers conducting the operation agreed that [**redacted**]. Not only would this [**redacted**] have caused grave diplomatic harm to Canada’s relationship [**redacted**] but it is likely that the resulting [**redacted**] would have also signaled [**redacted**] that CSIS could not to be trusted [**redacted**]. Such an outcome would have also potentially created legal and other accountability issues for CSIS, its officers, and the GC.

CSIS operational employees informed NSIRA that this operation’s legacy has had a chilling effect on CSIS-PS relations. CSIS-HQ rejects this perspective, claiming instead that there continues to be close collaboration and frequent information sharing with counterparts at PS. Irrespective of which perspective is accurate – CSIS employees or management – this review makes the case for PS to take on a much more robust role in upholding its responsibilities in relation to CSIS. If PS is prepared to adopt this stance, there will be opportunity for more timely and thorough discussions with CSIS on complex operations, with direct benefit to ministerial accountability.

Responsibility for Briefing the Minister [redacted]

Finding 3. NSIRA found that Public Safety and CSIS failed in their responsibility to provide timely and accurate information to the Minister of Public Safety about [**redacted**] human source [**redacted**] operation.

The Minister is accountable, yet PS and CSIS are responsible for sufficiently briefing the Minister. In addition to certain provisions within the CSIS Act that require engagement of the Minister, the 2015 MD on Operations and Accountability, [**redacted**].

PS and CSIS use a variety of communication methods to keep the Minister of PS apprised of CSIS’s activities. The Director’s annual report to the Minister provides the most comprehensive ex post facto coverage of CSIS activities. Other communication tools are used to help ensure compliance with MD’s stipulation to notify the Minister of source operations that may engage in activities that could discredit the Service or the Government. This includes regular classified briefings by CSIS, attended by PS and other portfolio representatives, as required. These engagements may include updates on the minutia of sensitive source operations, to information of a more strategic nature. There are also briefing packages, information notes, presentations by subject matter experts, as well as private discussions, either in person or by secure phone, between the Minister and the DM and/or CSIS Director. Given the operational tempo of some national security matters, some exchanges involving the Minister are not formally scheduled (e.g. they may occur adjacent to other briefings, during foreign and domestic travel, and on an urgent basis).

Throughout this review NSIRA listened to the perspectives of those most involved in ensuring that the right information is provided to the Minister at the appropriate time, and with proper context. NSIRA interviews revealed that day to day working realities are not conducive to reflective thought, with one individual describing their role as “air traffic controller,” which requires prioritizing a large volume of information destined for the Minister. Interviewees also described dealing with the realities of limited ministerial availability; having to place trust in a complex bureaucracy; comprehending incomplete and/or inaccurate information as part of the realities of national security; and limited technological options for sensitive transactions when the Minister is not in Ottawa.

Despite the challenges, PS and CSIS are rarely unaware of potentially relevant issues that should be briefed to the Minister. CSIS is aware that certain MDs impose a notification requirement on the CSIS Director to proactively identify known issues; this extends to when a new Minister is transitioning into the role. The MD on Accountability requires the Director to advise the Minister of issues on a case-by-case basis when necessary. A case of necessity could include providing a Minister with context on past operations that may become matters of litigation and/or sources that might be in peril. For example, CSIS has acknowledged to NSIRA that the Minister of PS could have been briefed at an earlier point in his tenure [**redacted**].

It is also the case that PS was aware of the historical, legal, reputational and foreign policy issues [**redacted**] and possessed sufficient information to expect challenges [**redacted**]. As such, the DM of PS had an equally compelling positive obligation to independently brief the Minister about these legacy implications when the Minister assumed their portfolio responsibilities. This is irrespective of whether or not CSIS, at the time, felt that this information was relevant to raise to the Minister.

While it is important to provide information to the Minister on the ongoing risks associated with legacy operations, even more critical is ensuring timely and accurate reporting on contemporary matters. This was particularly evident during the [**redacted**] operation, where the Minister was initially informed [**redacted**] in a classified briefing by CSIS on [**redacted**] – the same [**redacted**] day that PS was first made aware. There is no official record for the Ministerial briefing on [**redacted**] Based on interviews with those who interacted with the Minister, CSIS provided reassurance that the operation was not unusual, and pointed out that the operation was not assessed as ‘high risk’ (which meant there was no obligation within MD to notify the Minister). However, in the opinion of one senior PS official, the limited time between being made aware of the planned [**redacted**] operational execution did not provide PS with sufficient ‘lead time’ to prepare and independently provide advice, and ultimately, led the Minister to feel like “his hands were tied”.

Contrary to the view of PS, CSIS maintains that “extensive efforts were made to ensure that the Minister and key partners were aware [**redacted**] during a compressed period of time” when the operation itself was being planned and executed. CSIS also defends the delay in informing PS and the Minister until it had [**redacted**] which the Service did not receive until [**redacted**] Finally, CSIS points to [**redacted**] the absence of adequate briefing-up by the Privy Council Office (PCO) to the Prime Minister (in advance [**redacted**] as factors that contributed to halting the operation.

The account by CSIS is not supported by the documentary record. CSIS knew well in advance [**redacted**].

[**redacted**] CSIS spent [**redacted**] with many other Canadian departments/agencies – including agencies within the public safety portfolio – as well as with international partners, Therefore, excluding PS was a choice. For instance, when NSIRA asked why PS was not involved in these discussions, CSIS stated that it was due to PS being policy focussed, not operationally engaged.

PS does not dispute CSIS’s interpretation of its role. For example, in answer to NSIRA’s questions, PS noted a preference to refrain from speaking about CSIS operational matters unilaterally to the Minister. In general, PS aims to have the DM and Director collaborate, as “would be expected by the Minister”. However, the roles of PS and CSIS are not synonymous; PS has a wider mandate, and this may, on occasion, necessitate unilateral PS-Ministerial discussions touching on CSIS activities. The desirable collaborative approach must not come at the expense of independent advice from PS. The alternative risks perfunctory interactions between CSIS, PS and the Minister which are a fait accompli.

CSIS’s claim that the Prime Minister was inadequately briefed understates the matter; there is no indication that the Prime Minister had any awareness of this operation. With sufficient forewarning and preparation, [redacted] not to halt this operation. For instance, the Information Note CSIS provided to the Prime Minister on [redacted] presented a more robust argument on the merits of [redacted] than that provided to the Minister of PS on [redacted].

It was not the timing of this operation [redacted] that led to the issues NSIRA observed with this case, but rather, the poor quality of operational preparation and consultation. PS and CSIS had an advance window [redacted] to prepare [redacted] it is reasonable to expect that broad consultation would have taken place among Government stakeholders.

Even once the Minister was aware of the operation, PS and CSIS did not provide the Minister with sufficient information. [redacted]. When CSIS briefed the Minister [redacted] it neglected to inform the Minister [redacted]. At the time, CSIS believed that this information was not relevant, and PS was in no position to provide an independent appraisal. [redacted] the Minister raised additional concerns about reputational harm to the Government, and the thoroughness of these initial briefings.

Finally, CSIS’s [redacted] memo addressing [redacted] which included a covering PS note as well as additional background materials, still provided the Minister with incomplete information. [redacted]

The memo’s description [redacted] failed to convey [redacted] had identified a number of CSIS activities as problematic, and potentially unlawful. Of note, [redacted] was that the CSIS Director had not complied with the then-2008 MD for Operations because he had failed to notify the Minister [redacted]. The [redacted] memo should have accurately reflected previous deficiencies in accountability to guide the Minister’s scrutiny of CSIS’s proposed operation.

Public Safety’s Role in Relation to CSIS

Finding 4. NSIRA found that Public Safety willingly remains dependent on CSIS to identify and receive relevant information, which inhibits Public Safety’s ability to prepare independent advice to the Minister about the activities and operations of CSIS.

PS’s role in providing independent advice to the Minister on the activities and operations of CSIS is neither clearly articulated in legislation, nor plainly captured within relevant policy instruments. Rather, such expectations are to be found in parliamentary discussions leading to creation of the CSIS Act, as well as associated commissions of inquiry. As reflected in its statutory framework, PS has an important complementary role to CSIS in providing the Minister with information needed to discharge ministerial leadership responsibilities in national security matters. For a brief synopsis of some of the more salient points in this respect, please refer to Annex B.

A recognition for the need for departmental scrutiny of the Service initially led to the creation of the Office of the Inspector General of CSIS (IG). Described as the “minister’s eyes and ears,” the IG was expected to monitor CSIS compliance with the law, ministerial direction, and operational policies, as well as comment on the Service’s overall performance. The IG reported directly to the DM of PS and was entitled to have access to any information under the control of the Service, similar in all respects to the powers granted to SIRC, and now NSIRA. In 2012, the IG was eliminated, which created a gap in PS’s information on and awareness of CSIS activities.

In September 2019, the Minister of PS issued a standalone MD to CSIS for Accountability. The intent of the new MD was to reinforce the Minister’s expectations of CSIS with respect to compliance with the law, duty of candor to the Federal Court, and particularly the duty to inform the Minister “of any such matter as is relevant to enable” the fulfillment of the Minister’s accountabilities. To compensate for the information deficit created by the loss of the IG, the MD also instituted a 2020 Framework for Cooperation Between Public Safety Canada and the Canadian Security Intelligence Service (Cooperation Framework) between PS and CSIS aimed at formalizing information transfer for accountability purposes.

From PS’s perspective, the 2020 Cooperation Framework has satisfactorily addressed the information deficit. NSIRA observed extensive information sharing through this process, facilitated through quarterly meetings between PS and CSIS. This is in addition to the frequent exchange of classified memos, emails and phone calls that occurs between PS and CSIS on all matter of issues.

Determining whether the CSIS Act, MD on Accountability, and the Cooperation Framework have created an information sharing regime that satisfies the needs of PS and the Minister is a central preoccupation of this review. Although each instrument provides gateways for information exchange from CSIS to PS, the overall regime has not compensated for the loss of the most important statutory authority possessed by the former IG: principally, unrestricted access to CSIS’s information holdings. Instead, CSIS controls information provision to PS. There is no indication that CSIS is deliberately constraining the ability of PS to prepare independent advice to the Minister. However, PS deference to CSIS viewpoints and overreliance on CSIS selected information and final products, cumulatively diminishes the DM of PS’s ability to provide robust independent advice to the Minister.

For example, PS does not have direct access to human source files, despite CSIS being first and foremost a HUMINT agency. PS also does not have routine access to CSIS operational risk assessments, nor has it taken measures to demand such access or availed itself when access has been granted. To illustrate, PS made three requests to CSIS for a copy of [redacted] risk assessment, the first [redacted] and a second and third time [redacted] The Service told NSIRA it granted PS an opportunity to see this document, with the proviso that, due to its sensitivity, the document could only be examined at CSIS HQ. At time of writing, PS had yet to examine this assessment.

Except for what is explicitly required by law or under the authority of MD, PS is reliant on CSIS to proactively provide information that the Service determines may require PS and/or Ministerial attention. As acknowledged by PS: (The department) must have enough information to inform the Minister; we cannot report what we do not have, or what we have only heard informally or through quick verbal exchanges.

When asked why it does not have proactive access to information, PS highlighted three considerations: first, the importance of maintaining CSIS information security; second, the Service’s operational tempo and limited PS resources would make timely assessment of additional information difficult; and finally, CSIS provides higher level information through the Cooperation Framework in accordance with PS’s policy and guidance role.

From CSIS’s perspective, unrestricted access to all of its holdings would be required for PS to be more active in the Service’s operations. CSIS believes that such unrestricted access would be inefficient, unnecessary, constitute a security risk, and would duplicate CSIS advice already provided to the Minister and copied to the DM of PS.

Having considered both CSIS and PS’s responses, this security and resource concerns are unpersuasive. First, the onus is on both PS and CSIS to establish a security infrastructure that facilitates access, even for the most sensitive of information. PS does not require unrestricted access to all CSIS holdings. Rather, it only needs access to those holdings which are necessary in the given circumstance to provide independent advice on the proposed activity beyond what was initially furnished by CSIS. Security controls already exist at CSIS, as do mechanisms that audit for security policy non-compliance. Second, if ensuring adequate accountability requires additional resource investment, then this is something which can be addressed through budgetary requests.

Finally, the distinction between policy and operations, as conveyed by both PS and CSIS, is not a useful paradigm. This bifurcation of responsibility was rejected after careful consideration by the commission of inquiry that led to the creation of CSIS, the McDonald Commission, and is also not consistent with Parliamentary deliberations on the relationship expected of CSIS and PS (or the Solicitor General’s department, as it was originally known). See Annex B.

PS must be in position to brief the Minister of PS on the broader equities and interests that will inform their decision. To provide this advice to the Minister, PS must have access to the specifics of CSIS operations. Although CSIS must retain management and control of its operational activities, this does not displace PS’s responsibility to ensure the Minister has all the information needed to make informed decisions and fulfill their accountability requirements [redacted] operation- which was exceptional but not novel- demonstrates the negative consequences of PS’s current approach.

Ultimately, to ensure the provision of rigorous and genuinely independent advice to the Minister, the DM of PS must rely upon the assistance of well-informed departmental officials. It is therefore incumbent upon the DM to ensure these officials have access to CSIS operational information required to fulfill their duties. PCO provides some useful guidance on the role of the Minister vis-à-vis their Deputy Minister. For example: Depending on the portfolio, the Deputy Minister may also be assigned certain specific responsibilities by the Minister. In those cases, it is important that the Minister provide clear guidance to all agency heads on his or her expectations with respect to the role of the Deputy Minister. This role must not infringe upon the accountability of the agency head.

To this end, the DM of PS already has tools available to further empower their employees in supporting ministerial accountability. The CSIS Act provides in subsection 7(3) that: The [DM PS] shall advise the Minister with respect to directions issued under subsection 6(2) or that should, in the opinion of the [DM PS], be issued under that subsection.

Recommendation 2. NSIRA recommends that the Minister of Public Safety take action to ensure that the Deputy Minister obtains any information required to fulfill their responsibility to provide independent advice to the Minister about the activities and operations of CSIS.

Ministerial Direction to CSIS

For the Minister of PS to be accountable to Parliament for the activities of CSIS, the Minister must be informed in advance of Service decisions and activities and must not be left to simply react to them. Under section 6(2) of the CSIS Act, the Minister may take the initiative in developing and conveying expectations to CSIS by issuing written direction to the Director.

Purpose and History

In the early years of the Service’s history, MD played a crucial role in shaping CSIS’s policy landscape, reflecting the Government’s evolving position on what constitutes necessary reporting on, and controls for, the Service’s operations and activities. Parliament encouraged the issuance of ministerial direction to CSIS, underscoring a key rationale for severing security intelligence from the ROMP: providing for detailed direction of intrusive intelligence activities without compromising police independence.

Throughout the 1990s, changes to ministerial direction were incremental. SIRC provided the catalyst for many of these modifications, for example highlighting in1995 the Service’s “seriously deficient” policy development for human sources. This deficiency was addressed, in part, by new MDs. Subsequent SIRC reviews focused on such matters as MDs for investigations on university campuses and investigations conducted under the CSIS Act’s provisions on “subversion.” Elsewhere, SIRC observed “policy lacunae” affecting CSIS’s ability to translate MD into operational policy, such as “definitions of scope which are ambiguous as to when the Minister must be consulted or advised.” By the end of the decade, there were twenty-eight MDs guiding CSIS.

In February 2001, the Minister issued an omnibus MD, which was modeled on the premise that most of the core elements of previous directions had been subsumed within applicable CSIS operational policies. Therefore, the Government determined that it was time to reduce and elevate MD to a more strategic level. Today, there are three MDs for CSIS that relate to accountability for operations: Threats to the Security of Canada Directed at Parliament and Parliamentarians (2023); Operations (2023); and, Accountability (2019).

Finding 5. NSIRA found that multiple Ministerial Directions to CSIS are subject to inconsistent and contradictory interpretation by those responsible for their implementation.

NSIRA observed that there are serious shortcomings in the current suite of MDs for CSIS. Crucially, there is no shared interdepartmental legal, policy or other documents that define the words and/or phrases used in MD. NSIRA was advised by PS to interpret these words according to their conventional meanings and pointed to the fact that these are not drafted with legal precision. However, this review revealed that many of the words and/or phrases within MDs are prone to inconsistent interpretation by those responsible for implementation.

For example, within the 2019 MD the word ‘consulted’ is interpreted by PS as meaning after-the-fact for reputational risk assessment, while the exact word within the same MD is interpreted by GAC and CSIS as meaning contemporaneously for foreign policy risk assessment. Words like consulted, notification and advised are used across MDs in an interchangeable way. In the 2019 MD, for instance, it states that the Minister expects to be “consulted or informed” regarding any action on which a Deputy Head would normally involve his or her Minister; this, despite obvious differences in the conventional meanings for consult and inform.

In another example from the 2019 MD, the Service is to notify the Minister, “in advance,” of operational activities where a novel authority, technique, or technology is used, or “prior to” activities where there is high risk. These sections of MD resulted in a number of informative interactions between NSIRA and interviewees responsible for providing information to and interacting with the Minister. For instance, some interviewees struggled to articulate the expected role of the Minister when informed or notified of a CSIS activity before operational execution. Interviewees were inclined to point to sections of MD that clearly stipulated where the Minister was expected to ‘approve’ something (like in the case of a warrant). However, these same interviewees had difficulty in explaining why it was necessary to inform or notify the Minister before other operational activities transpired. The interviews revealed that, with exception where it is clearly stated otherwise, the role expected of the Minister is to be a passive recipient of information.

This was exemplified during the [redacted] operation. While being briefed by CSIS and PS, the Minister enquired what was expected of him, to which the Service explained that the briefing was for information only, although there may be a need [redacted] This answer to the Minister was consistent with a number of comments made by interviewees to NSIRA, where there appeared to be either hesitation, or an outright failure to understand the Minister’s authority to direct the operation. The confusion which ensued once the [redacted] operation was halted is also reflective of this observation.

A similar issue exists within the phrase “in a timely manner” used in both 2023MDs, in which there is no temporal deadline for when a Minister should expect to receive information on ongoing high risk operational activities, or of “all instances of threats to the security of Canada directed at Parliament or parliamentarians”. Certain CSIS employees interviewed by NSIRA believe that the Service’s risk system is not dynamic- meaning that it cannot systematically provide ongoing operational risk assessments, regardless of this expectation. Moreover, ‘all instances of threats’ has no qualification, and is likewise prone to inconsistent interpretation, which means the Minister may not be fully informed.

Some interviewees had difficulty in explaining the key objectives of MD. The review identified that challenges in explaining aspects of direction may be the result of similar themes existing concurrently within multiple MDs. For instance, direction on risk is spread across the 2019 MD on Accountability and 2023 MD on Operations, and the preoccupations of the era in which each of these documents were written do not seamlessly weave together to create clear and succinct guidance.

Finding 6. NSIRA found that when preparing Ministerial Directions to CSIS, Public Safety insufficiently consulted with Global Affairs Canada and CSIS.

GAC was not sufficiently consulted on changes made to the 2023 MD on Operations affecting risk assessments for threat reduction measures, as well as approvals from the Minister of Foreign Affairs. GAC officials expressed the importance of maintaining visibility on and approvals for CSIS activities that engage their Minister’s accountabilities. Likewise, while CSIS was consulted on the 2023 MD on threats directed at Parliament and Parliamentarians, CSIS reports that its input “was not necessarily provided to the Minister’s Office” nor was it incorporated into the MD that was issued, despite the new guidance being very specific regarding operational expectations.

Finally, although PS and CSIS were involved in consultations involving changes to risk expectations within the 2023 MD on Operations, it is clear that these engagements were insufficient. Key stakeholders from both PS and CSIS could not explain to NSIRA the rationale for inclusion of entire sections of this MD, and how [**redacted**]

Recommendation 3. NSIRA recommends that the Minister of Public Safety consolidate ministerial directions into clear, concise and harmonized instruments that are derived from meaningful consultation among those responsible for their implementation.

CSIS’s Risk Assessment Process

Over the past thirty-five years, CSIS human sources have occasionally been involved in unlawful activities, [**redacted**] In the past year alone, [**redacted**] memos to the Minister of PS touched on high risk to either a legacy or active CSIS human source. [**redacted**] it is appropriate that the identification, assessment and mitigation of risk has been a longstanding preoccupation for CSIS.

Purpose and History

The first significant step towards a modern risk system at CSIS was the result of a serious operational failure. [**redacted**] SIRC would later assess that [**redacted**] could not be attributed to any one action. Rather, a litany of factors were involved, including: [**redacted**] CSIS’s limited foreign operational capabilities, the lack of rigorous policies and procedures to manage foreign operations, insufficient risk management and training for [**redacted**] and CSIS employees, and only a developing awareness of the challenges of conducting foreign operational activities with allies.

The operation resulted in the issuance of new MD in 2008 that emphasized the increased risk of CSIS’s operations and stipulated that the greater the risk associated with a particular activity, the higher the authority required for approval. This MD was silent on the process used to determine risk, reporting requirements to the Minister were vague, and participation from external stakeholders remained nascent.

The expectation for a “four pillar” risk analysis- i.e. legal, political/reputational, foreign policy, and operational- was first outlined within MD issued in 2015. Following [**redacted**] SIRC recommended the development of an appropriate framework to capture risk considerations. This recommendation was addressed within the MD on Accountability in 2019, and in particular, provided further clarity on the external roles expected by DOJ for legal risk, GAC for foreign policy risk, and PS for reputational risk. [**redacted**]

Finding 7. NSIRA found that CSIS’s risk assessment process has evolved to become the central mechanism for planning operations and managing associated risks, and, while it is generally effective, it lacks clear guidance to employees on when risk should be reassessed as operations evolve.

NSIRA examined a sample of over 100 risk assessments and supporting documentation and did not observe any non-compliance with law, MD or operational policies. Nonetheless, there remain some issues related to CSIS’s operational risk pillar. For instance, stakeholder interviews with NSIRA pointed to an absence of formal processes to capture ‘lessons learned’ among regional counterparts and acknowledged the lack of standardized language in risk assessments. Moreover, the HQ center of excellence for risk does not have visibility on all risk assessments and lacks the technological ability for systematic trend analysis of the hundreds of risk assessments produced each year.

According to CSIS, outside of the [**redacted**] approval cycles for operations, operational risk assessments may be reassessed and adjusted for cause on an adhoc basis. In the event of a change to the operating environment or operational activity, which may have an impact on risk, the employee responsible for the operation should inform the relevant risk expert in a timely manner, including providing an updated risk statement. Stakeholders, including GAC, are consulted as needed and if the resulting risk reassessment increases the overall risk, new approvals are required. However, CSIS currently lacks clear guidance to employees on when exactly risk should be reassessed outside of the standard [**redacted**] interval. A CSIS assessment on the state of the risk process raised similar concerns, and also pointed to an inconsistent understanding by management of the risk appetite for each of the four pillars of risk.

Recognizing the need for improvements, the Service launched project [**redacted**] which aims to create a new operational governance system, augmented by a modernized risk assessment system. Although in the early stages of development, NSIRA meetings and interviews with CSIS risk stakeholders suggest that the future system will reduce emphasis on narrative-type assessments and promote use of risk criteria, which are established reference points against which the significance of a risk is evaluated and measured. [**redacted**] The findings and recommendations contained within this report should inform project

Legal Pillar

Finding 8. NSIRA found that legal advice is often absent from the final risk assessment record for CSIS operations.

The majority of risk assessments reviewed by NSIRA did not include written notation of DOJ consultation, and therefore, gave the impression that legal risk was under-assessed. DOJ as well as risk stakeholders across the Service, provided three key reasons for why written notation was absent from final risk assessments. First, the Service’s justification framework under the CSIS Act for acts or omissions that would otherwise constitute offences under Canadian law has in some circumstances mitigated the identified legal risks. Second, DOJ is more frequently being consulted at an earlier stage of operational planning. This provides an opportunity to address legal concerns at earlier stages in the operational planning. Third, [**redacted**]

While earlier legal engagement is a positive development and may certainly assist in mitigating legal risk, the need for a documented legal risk assessment should always be required, even if this merely notes the reliance upon a foundational legal opinion. The risk assessment process provides managerial awareness of and approval for specific operations and is a mechanism to capture the rationale for these decisions. Also, while the justification framework may address certain elements of legal risk, there are a number of other sources of legal risk. It is therefore essential that the final risk approval captures the thinking that went into the legal risk pillar to ensure accountability for decision makers.

Finding 9. NSIRA found that the scope of legal considerations within legal risk assessment is under-inclusive.

The importance of consistently memorializing legal risk was underscored when identifying non-Canadian criminal law risks. This includes risks arising from sources of civil liability, from foreign domestic law, and international law risks to Canada. The review revealed that it is not entirely clear to all parties which risk stakeholder is ultimately responsible for identifying and assessing these sorts of legal risks. For example, at separate briefings with GAC and the DOJ’s National Security Litigation and Advisory Group (NSLAG), the former stated that their Legal Affairs Bureau was engaged in assessing international law, whereas the latter explained that their role is to identify all legal risks associated with CSIS operations.

There is some justification for both parties to assess international law risks, with NSLAG being legal adviser to CSIS on all areas of law with links to legal subject matter experts across the DOJ (including, for example, the Constitutional, Administrative, and International Law centre of expertise), while GAC Legal Affairs Bureau counsel support their Minister’s duties in respect to the development and application of international law, including its application to Canada’s external relations [**redacted**].

While CSIS may, as of 2019, use the justification framework to grant a source limited legal protection under Canadian law, this framework offers no protection under foreign domestic laws and is irrelevant when considering Canada’s international law obligations. For example, if a source is granted protections under Canadian law through the justification framework for what would otherwise constitute offences that apply extraterritorially (e.g. terrorist financing, violations of sanctions), they can still face jeopardy under the legal regime where the operation is occurring. While acknowledging the attendant and practical difficulties, these types of risks need to be identified and considered in each relevant pillar (i.e. operation, legal, foreign policy and reputation risk).

Recommendation 4. NSIRA recommends that CSIS, in consultation with the Department of Justice and Global Affairs Canada, ensure that legal risk assessments are comprehensive and memorialized in writing.

Foreign Policy Pillar

Finding 10. NSIRA found that Global Affairs Canada and CSIS do not have a shared vision with respect to the role of Global Affairs Canada in the foreign policy risk assessment.

GAC and CSIS use two mechanisms to implement MD requirements for foreign policy risk assessments. The first is the [**redacted**] which is used in the context of national security investigations, and foreign intelligence collection, while the [**redacted**] is used for threat reduction measures. CSIS’s centralized risk unit initiates the consultation process with GAC after identifying foreign policy issues, or as stipulated within the two mechanisms.

The review examined all of GAC’s foreign policy risk assessments provided to CSIS for [**redacted**] (i.e. [**redacted**] total, of which [**redacted**] were high risk). In conducting this analysis, NSIRA took note of recent commentary by the National Security and Intelligence Committee of Parliamentarians Special Report on GAC, which observed that the Department has limited policies, procedures or internal committee structures to guide or oversee its provision of foreign policy risk assessments to CSIS.

Although non-compliance issues were not observed, CSIS and GAC had no agreed upon turnaround time for the latter’s foreign policy risk assessments. NSIRA also observed that, on occasion, GAC requests to CSIS for additional assessment-related information were made only after CSIS’s proposed operation had become an urgent priority. For example, CSIS had to follow up with GAC after waiting twenty-one days for a risk assessment. At this point, [**redacted**] which led CSIS to cite exigent circumstances under the consultation mechanism and proceed without the final submission. After CSIS executed the operation, GAC informed CSIS that the operation had carried a high risk.

In the broader analysis, the risk-consultation process between GAC and CSIS, while professional, is nonetheless at a crossroads. There is a concerted effort by CSIS to further restrain the flow of sensitive information to GAC to that which the Service believes is absolutely necessary for the foreign policy risk assessment. According to CSIS, this restriction is to protect highly sensitive operational information from risk of unauthorized disclosure. In addition, CSIS wants to establish service standards for the timely production of these assessments. GAC believes it can meet any negotiated service standard so long as it is granted sufficient access to CSIS information. Project [**redacted**] could further complicate matters, [**redacted**] likely reducing GAC access to day-to-day operational information from CSIS. Any further limitations on insight into CSIS activities should be avoided, as this would generate an unacceptable accountability gap for the Minister of Foreign Affairs.

The importance of GAC having insight on certain CSIS activities was illustrated during [**redacted**] CSIS had not apprised GAC of this operation [**redacted**] This undermined the ability [**redacted**] to convey the impression that GAC had adequate knowledge of CSIS activities [**redacted**]

Managing Canada’s foreign policy has become more complex in the ensuing years, particularly following recent diplomatic crises with China and India. As CSIS continues collection and threat reduction activities targeting foreign state actors, this will often engage the Minister of Foreign Affairs’ accountability equities, and will likewise require consultation with GAC.

Recommendation 5. NSIRA recommends that any pending changes to CSIS’s risk assessment process maintain a robust consultation and information sharing mechanism between Global Affairs Canada and CSIS.

Reputational Pillar

Following the [**redacted**] PS believed that the [**redacted**] reputational risk rating assigned to the operation was flawed, and that the timing of the assessment failed to provide the Minister with sufficient warning. PS only learned from CSIS about the risk rating, rather than reviewing the actual assessment, exasperating PS’s concerns. This prompted PS to question the sufficiency of CSIS’s risk assessment process generally, and is the reason risk assessment became one of the central issues examined by NSIRA in this Ministerial referral.

Following an examination of the facts of this case, the risk assessment process was not the reason why the [**redacted**] operation was jeopardized. The risk assessment process is not the sole trigger for ministerial engagement. All risk assessments contain elements of subjectivity and are open to challenge. Despite this inherent weakness, CSIS’s [**redacted**] risk assessment followed the established process. CSIS and PS always retain the option of briefing the Minister, when appropriate, regardless of the risk rating.

While high-risk assessments must be briefed to the Minister prior to operational execution and therefore may provide a limited window for earlier engagement, [**redacted**] More often than not, in cases that are not high risk, it comes down to sound judgement by senior leadership on when to engage the Minister.

Another factor to consider is that it is standard practice for CSIS to create risk assessments [**redacted**] This was eight days after the Minister and PS had been informed by CSIS of the planned operation, and therefore, by this point everyone who needed to be aware had been informed.

Finding 11. NSIRA found that Public Safety is not adequately contributing to the preparation of reputational risk assessments.

NSIRA observed systemic challenges in the way that the reputational pillar of the risk assessment is organized. These challenges limit the degree to which the risk assessments facilitate ministerial control of CSIS. The 2019 MD on Accountability states that: Reputational risk is to be assessed, in consultation with Public Safety Canada, and include the potential for public controversy, as well as the risk of discrediting the Service or the Government of Canada.

First, as noted previously, there are no legal, policy or other documents that define ‘consultation’ outside of the context of the MD. PS has decided to interpret consult as meaning after the fact. Therefore, other than high risk operations where the Minister must be notified, the vast majority of reputational risk assessments are ‘consulted’ as part of information exchanged at meetings held under the PS/CSIS Cooperation Framework. These meetings occur on a quarterly basis, where CSIS provides examples of reputational risk assessments for specific operations. Given the fixed timing of these meetings, most of the operations discussed have either already commenced or are completed. PS may use this forum to provide strategic guidance on reputational risk for future operations; however, CSIS told NSIRA that meaningful leadership in this respect is the exception.

This observation raises a second issue: “ownership” of the reputational risk assessment. All non-CSIS risk stakeholders- i.e. PS, GAC, DOJ- share the viewpoint that reputational risk is difficult to define and exists simultaneously within all of the risk pillars, and therefore, may not be assessed as comprehensively as warranted. The purpose of having separate risk pillars is to draw attention to specific considerations for approval authorities.

PS believes that providing strategic advice on reputational risk addresses the requirements of the MD. NSIRA, however, did not observe evidence of a comprehensive and systematic approach to assessing reputational risk. For example, PS informed NSIRA that CSIS had not consistently been performing reputational risk assessments for activities [**redacted**].

As this example suggests, in practice, reputational risk assessments are situated with CSIS. According to the Service, the risk program is run separately from operations, [**redacted**] administered by specialists who are solely responsible for this function. The approval authority for reputational risk is a senior manager who reports to the non-operational Deputy Director Policy and Strategic Partnerships. This group, being external to operations, is expected to bring a unique vantage point, being also responsible for Cabinet and Parliamentary Affairs, external communications and media relations, and is the principal interlocutor with PS on CSIS policy and governance matters. However, NSIRA believes that despite these internal CSIS guard rails, PS’s decision to permit CSIS to make reputational risk assessments on its own is not without consequences.

The requirement in MD to undertake external consultation in assessing risk did not come about by accident. Rather, this accountability axiom emerged as a direct response to operational failures and recognition by Government that CSIS, however well intentioned, may not be best placed to consider all risk equities for the GC while carrying out operational activities. It is therefore essential to ensure that CSIS’s risk assessment process will capture a diverse range of perspectives and, in particular, a non-Service viewpoint in assessing reputational risk to the Government of Canada prior to operational execution.

Finally, it is instructive to compare the role played by PS with those of GAC and DOJ. When requested to do so, these departments each provide CSIS with an independent risk assessment. There is no use of proxy responsibility and after-the fact consultation. Yet, PS provides no similar, independent input into the assessment, even on a topic (i.e. reputational risk) where it may be better positioned to consider reputational consequences for the Government as a whole.

Recommendation 6. NSIRA recommends that Public Safety and CSIS develop a more robust consultation mechanism for reputational risk assessment for CSIS operational activities, and that these assessments account for the risk of discrediting the Government of Canada.

Conclusion

The system of Ministerial accountability for CSIS is in need of serious attention. Building a stronger system of accountability now will help prepare for the inevitable [**redacted**] operations of the future, and reduce the likelihood of a repeat of the confusion and risk incurred [**redacted**].

Nevertheless, no amount of writing or wordsmithing of MDs, or improvements to risk processes, are a substitute for a culture of accountability. CSIS and PS must engage with each other with the common objective of ensuring that their shared Minister is seized with the information required to fulfill their ministerial responsibilities.

Annex A. [redacted] – A Case Study

A1. [**redacted**]

Background

A2. [**redacted**] CSIS did not declare this activity to their [**redacted**] counterparts.

A3. [**redacted**]

A4. Key to [**redacted**] operational activities on behalf of CSIS [**redacted**]

A5. [**redacted**] SIRC [**redacted**] launched are view, which included an overview of the source [**redacted**] operation [**redacted**]. The [**redacted**] review findings and recommendations aimed at addressing a number of interrelated issues, including: legality of operations for sources participating in terrorist facilitation networks, ministerial direction, risk management, internal oversight, identity management, domestic and foreign partnerships, loss of operational environments and foreign strategic orientation. CSIS accepted all of SIRC’s recommendations, and these improvements were subject to SIRC scrutiny in subsequent years.

A6. [**redacted**]

A7. [**redacted**]

A8. [**redacted**] activities [**redacted**] were a catalytic event for CSIS. The [**redacted**] source [**redacted**] was a direct result of CSIS failing to disclose the operation. This situation was further exacerbated when CSIS decided to [**redacted**]. According to CSIS, the relationships [**redacted**] has reportedly been on an [**redacted**].

A9. [**redacted**] exposed limitations in Ministerial awareness of CSIS operations. Pursuant to the 2008 Ministerial Direction (MD) for Operations (i.e. the precursor for the 2015 MD), the Director needs to: Notify the Minister when there is a potential that a CSIS activity may have significant impact on Canadian interests, such as discrediting the Service or the Government of Canada or giving rise to public controversy.

A10. [**redacted**] This incident received executive level attention within CSIS about the appropriateness of [**redacted**] activities. Yet, CSIS did not inform the Minister of these events. In its [**redacted**] review, SIRC found that in order to comply with the 2008 MD, the CSIS Director should have notified the Minister [**redacted**].

A11. [**redacted**] SIRC also raised concerns about the legality of CSIS’s activities. SIRC found that CSIS had failed to create a timely strategic plan that included legal advice, outlining clear parameters for [**redacted**] continued participation [**redacted**] At the time, CSIS viewed Crown immunity as a possible [**redacted**] abandoned this perspective in response to subsequent DOJ legal advice. The Federal Court discussed the difficult sequencing of legal advice on the Crown immunity question (and controversy over its application) in an unrelated decision concerning CSIS’s candour in warrant applications. Ultimately, the legal risks identified in the [**redacted**] operation provided motivation for the CSIS Act’s justification framework, enacted into law by the National Security Act, 2017.

A12. [**redacted**]

Annex B. Role of Minister

The “Minister”, for the purposes of the CSIS Act, is the Minister of Public Safety and Emergency Preparedness. The Minister has several roles, including that in section 6(1): “The Director, under the direction of the Minister, has the control and management of the Service and all matters connected therewith.”

Development of the CSIS Act

B1. The nature of this ministerial direction was a focus of discussion prior to the enactment of the CSIS Act. The McDonald Commission of Inquiry, charged with scrutinizing wrong-doing by the RCMP Security Service in the 1970s, proposed the creation of what became CSIS. It discussed at length the degree of oversight the Minister should exercise over the proposed security service.

B2. It concluded that while the Minister was in no position to direct the “day-to-day operations of the agency any more than can the Minister of any other department”, “there must be no fetters on the Minister’s legal right to give such direction provided that such direction is consistent with the authority granted to the security intelligence agency under the Statute.”

B3. The Commission firmly rejected any distinction limiting the Minister to policy (as opposed to operational) direction, concluding that the boundary between the two concepts was unclear and uncertain. Thus, the Minister should be responsible for, among other things, “reviewing difficult operational decisions involving any questions concerning legality of methods or whether a target is within the statutory mandate”. More generally, “where day-to-day operations raise significant policy questions, the Deputy Minister and [the security service head] must keep the Minister informed and seek his advice and direction.”

B4. The Commission rejected arguments that would put the intelligence service on a footing analogous to that of the police, who enjoy considerable operational independence. The risk that the intelligence service might be politicized by partisan ministerial direction was to be mitigated, not by limiting ministerial oversight, but by a robust system of specialized review.

B5. The Commission underlined the importance of information flow enabling ministerial oversight. It recommended that, except in extraordinary circumstances, the intelligence service director should report through the Deputy Minister and not directly to the Minister. This, the Commission concluded, would “avoid the concentration of too much power in the hands of the” intelligence service director. Yet, while the Deputy Minister would be “the principal adviser of the Minister, including the area of responsibility covered by the” intelligence service, the service director (with the Deputy Minister’s knowledge and consent) “should be reporting to the Minister on operational problems, and…policy proposals developed by the agency”. The Deputy Minister must be equipped to “appraise for the Minister the quality of the reports produced by the agency so that the Minister can assess the agency’s work”, albeit with limits tied to source identity protection.

B6. Following the McDonald Commission, the ultimate CSIS Act required two bills to enact, after members of Parliament and civil society condemned the original law project as too sweeping. Following this initial controversy, a special Senate committee proposed amendments to the original bill. Like the McDonald Committee, it too addressed the Minister’s oversight role. This “Pitfield” Committee agreed that the Minister should give direction to CSIS. It also supported the codification of a role for the Deputy Minister in keeping the Minister informed of CSIS operations- something that would ensure that the CSIS Director “does not acquire the de facto status of deputy to the Ministers in matters of security”. It opposed a provision in the original bill that limited the Minister’s ability to override the Director’s decision on certain limited operational matters.

B7. The Committee wrote that this “override” limit would “insulate the Minister to too large a degree from operational matters. Affixing political responsibility for acts of the CSIS would be extremely difficult and thus effective control would be proportionately less likely”. The Committee shared the opinion of the McDonald Commission: the risk of partisan abuse by the Minister would be limited by effective specialized review of CSIS conduct. The Committee saw merit in the idea that “ministerial interventions should have to be formally submitted, in writing, to the Director and also transmitted” to the review body. It also concluded that “[i]n any event, the danger of political abuse is far outweighed by the need for effective control and responsibility”.

B8. While the Minister should rarely intervene in operations, there should be no legal fetter on their doing so. Instead, CSIS “should be an ‘open book’ to the Minister, who will consequently have full political responsibility for matters about which [the Minister] can be expected to have knowledge.

CSIS Act

B9. The final CSIS Act codified a specific oversight role for the Minister in several areas, including of an operational nature. Amendments in 2015 and 2019 expanded this list. As noted, section 6 subjected the Director’s control of CSIS to the direction of the Minister. This provision includes no “override” of the sort limiting ministerial direction found in the original (rejected) CSIS bill. It contains no distinction between policy and operations.

B10. In terms of information flow to the Minister, section 6 does not include specific instructions that the Director keep the Minister informed of CSIS operations. Parliamentarians rejected a proposed amendment to that effect in clause-by clause in the House of Commons in 1984. However, this rejection came after the Minister explained that this information obligation was already implicit in established duties on officials.

B11. The Act does specify that the CSIS Director must consult with the Deputy Minister on the general operational policies of CSIS, warrant applications, or any matter for which consultation is required by ministerial direction.

Later Parliamentary Scrutiny

B12. In reviewing the CSIS Act in 1990, the House of Commons special committee on the CSIS Act concluded that section 6 “places the [Minister] firmly in the driver’s seat by making the Director’s control and management of the Service subject to written ministerial directions’’. By then, ministerial direction under section 6 had reached operations. For instance, in 1988, the Minister directed that any investigation of subversion (paragraph d of the definition of “threats to the security of Canada”) beyond open source requires approval of the Minister.

ANNEX C. Findings and Recommendations

Accountability and Consequences for Halting [redacted] Operation

Finding 1: NSIRA found that a decision was made to halt an active CSIS operation overseas that was not made by the CSIS Director under section 6(1) of the CSIS Act, and for which there is no written record of a direction coming from the Minister of Public Safety under sections 6(1) or 6(2) of the CSIS Act.

Recommendation 1: NSIRA Recommends that whenever there is a decision affecting an active CSIS operation, which is not made by the Director of CSIS or their delegates, it must come as a direction from the Minister of Public Safety under section 6(1) of the CSIS Act and should be accompanied by a written record in keeping with section 6(2).

Finding 2: NSIRA found that [**redacted**] halted an active operation, creating unnecessary danger for the CSIS team [**redacted**] and caused harm to Canada’s international reputation.

Responsibility for Briefing the Minister [redacted]

Finding 3: NSIRA found that Public Safety and CSIS failed in their responsibility to provide timely and accurate information to the Minister of Public Safety about [**redacted**] human source [**redacted**] operation.

Public Safety’s Role in Relation to CSIS

Finding 4: NSIRA found that Public Safety willingly remains dependent on CSIS to identify and receive relevant information, which inhibits Public Safety’s ability to prepare independent advice to the Minister about the activities and operations of CSIS.

Recommendation 2: NSIRA recommends that the Minister of Public Safety take action to ensure that the Deputy Minister obtains any information required to fulfill their responsibility to provide independent advice to the Minister about the activities and operations of CSIS.

Ministerial Direction to CSIS

Finding 5: NSIRA found that multiple Ministerial Directions to CSIS are subject to inconsistent and contradictory interpretation by those responsible for their implementation.

Finding 6: NSIRA found that when preparing Ministerial Directions to CSIS, Public Safety insufficiently consulted with Global Affairs Canada and CSIS.

Recommendation 3: NSIRA recommends that the Minister of Public Safety consolidate ministerial directions into clear, concise and harmonized instruments that are derived from meaningful consultation among those responsible for their implementation.

CSIS’s Risk Assessment Process

Finding 7: NSIRA found that CSIS’s risk assessment process has evolved to become the central mechanism for planning operations and managing associated risks, and, while it is generally effective, it lacks clear guidance to employees on when risk should be reassessed as operations evolve.

Legal Pillar

Finding 8: NSIRA found that legal advice is often absent from the final risk assessment record for CSIS operations.

Finding 9: NSIRA found that the scope of legal considerations within legal risk assessment is under-inclusive.

Recommendation 4: NSIRA recommends that CSIS, in consultation with the Department of Justice and Global Affairs Canada, ensure that legal risk assessments are comprehensive and memorialized in writing.

Foreign Policy Pillar

Finding 10: NSIRA found that Global Affairs Canada and CSIS do not have a shared vision with respect to the role of Global Affairs Canada in the foreign policy risk assessment.

Recommendation 5: NSIRA recommends that any pending changes to CSIS’s risk assessment process maintain a robust consultation and information sharing mechanism between Global Affairs Canada and CSIS.

Reputational Pillar

Finding 11: NSIRA found that Public Safety is not adequately contributing to the preparation of reputational risk assessments.

Recommendation 6: NSIRA recommends that Public Safety and CSIS develop a more robust consultation mechanism for reputational risk assessment for CSIS operational activities, and that these assessments account for the risk of discrediting the Government of Canada.

Date Modified:: 2025-10-20

Communications Security Establishment’s Network-Based Solutions and Related CS/IA Activities: Report

Communications Security Establishment’s Network-Based Solutions and Related CS/IA Activities

Report

Table of Contents

Executive Summary
Glossary of Terms
List of Acronyms
Introduction
Overview of NBS and CSIA Activities
Analysis
CONCLUSION
ANNEX A: Lifecycle of Information
ANNEX B: Cross-aspect use of cybersecurity information
ANNEX C: Findings & Recommendations
1. Findings
2. Recommendations

Date of Publishing:

May 21, 2025

Download PDF

Executive Summary

The Government of Canada views cybersecurity as one of the most serious economic and national security challenges facing Canada and Canadians. The coming into force of the Communications Security Establishment Act (CSE Act) in 2019 introduced significant changes to CSE’s authorities, including to CSE’s cybersecurity and information assurance (CSIA) activities. While the acquisition and analysis of vast amounts of information is critically important to identifying and preventing cybersecurity threats, CSIA activities are often intrusive and engage important personal privacy interests.

This is NSIRA’s first review of CSE’s CSIA activities. In addition to CSE, NSIRA incorporated Shared Services Canada (SSC) into this review, given its role as a system owner for a large portion of Government of Canada networks. This is the first time NSIRA has reviewed SSC.

The review initially centered on one of three primary cybersecurity solutions used by CSE to detect and prevent threats against the digital information and information infrastructures it protects: network-based solutions (NBS). In doing so, the review mapped the lifecycle of cybersecurity information as it is initially captured by the NBS sensors and is subsequently processed through the various systems that comprise CSE’s cyber defence ecosystem.

Overall, NSIRA found that CSE operates a comprehensive and integrated ecosystem of cybersecurity systems, tools, and capabilities to protect against cyber threats, with a design that incorporates measures meant to protect the privacy of Canadians and persons in Canada.

NSIRA also analyzed two main thematic areas: transparency, and privacy. NSIRA made findings and recommendations regarding the transparency of some of CSE’s information provided, and commitments made, to the Minister of National Defence in its applications for Ministerial authorizations for CSE’s cybersecurity activities on federal infrastructure.

NSIRA also examined a specific case pertaining to a cybersecurity information acquisition activity by CSE from an external source that may have implicated a reasonable expectation of privacy of Canadians or persons in Canada. CSE continued this activity after the Intelligence Commissioner determined he could not approve the activity as proposed in the corresponding Ministerial authorization. NSIRA made findings and recommendations about how CSE addressed this issue, which resulted from an incongruence in the CSE Act that restricts the ability for an authorization to be issued for this specific acquisition activity under the CSIA aspect of CSE’s mandate.

While CSE only partially met NSIRA’s expectations for responsiveness on this review, NSIRA was able to independently verify CSE information provided during the review.

Glossary of Terms

Five Eyes. This term refers to the intelligence-sharing partnership between Canada, the United States of America, the United Kingdom, Australia, and New Zealand.

Incidentally. As per section 23(5) of the CSE Act: “with respect to the acquisition of information, means that the information acquired was not itself deliberately sought and that the information¬ acquisition activity was not directed at the Canadian or person in Canada.”

Minister. In this report, ‘Minister’ refers to the Minister of National Defence.

Private Communication (PC). As per section 183 of the Criminal Code. Any oral communication, or any telecommunication, that is made by an originator who is in Canada or is intended by the originator to be received by a person who is in Canada and that is made under circumstances in which it is reasonable for the originator to expect that it will not be intercepted by any person other than the person intended by the originator to receive it.

Publicly available information (PAI). As per section 2 of the CSE Act, PAI means “information that has been published or broadcast for public consumption, is accessible to the public on the global information infrastructure or otherwise or is available to the public on request, by subscription or by purchase. It does not include information in respect of which a Canadian or person in Canada has a reasonable expectation of privacy.”

Reasonable Expectation of Privacy (REP) of a Canadian or person in Canada. Section 8 of the Charter of Rights and Freedoms provides that everyone has the right to be secure against an unreasonable search or seizure. A search for the purposes of section 8 is any state activity that interferes with a “reasonable expectation of privacy” (REP). As noted above, information in respect of which a Canadian or person in Canada has a REP is excluded from the definition of PAI in the CSE Act. CSE Act ss. 22(3) and 22(4) prohibit certain activities that interfere with the REP of a Canadian or person in Canada furthering the Foreign Intelligence and Cybersecurity and Information Assurance aspects of their mandate unless authorized by the Minister as set out in the Act.

Solution. In this report, “solution” refers to a system combining hardware and/or software that allows it to monitor for and respond to cyber threats. This can include a broad range of specific capabilities.

System owner. In this report, “system owner” refers to a Government of Canada department or agency, or a component of it, that perform duties related to the management or protection of computer systems, sometimes including the systems of other departments or agencies. In the case of CSE’s NBS cybersecurity program, [**redacted**] departments or agencies are “partners” of CSE in the context of implementing its NBS cybersecurity program (“NBS partners”). NBS partners are system owners for various Internet-connected networks; some of the partners further offer these NBS-protected networking services to other departments or agencies. The [**redacted**] NBS partners are SSC, [**redacted**] and CSE itself.

System user. In this report, “system user” refers to an individual user of a computer system or network

List of Acronyms

CBSA: Canada Border Services Agency
CHS: Confidential Human Source
CHSC: Confidential Human Source Program Coordinator
CHS-CC: Confidential Human Source Contact (or Confidential Contact)
CHS-P: Prospective Confidential Human Source
CHS-R: Registered Confidential Human Source
CHSPP: Confidential Human Source Program Participant
CSIS: Canadian Security and Intelligence Service
DND/CAF: Department of National Defence/Canadian Armed Forces
DRC: Designated Regional Coordinator
IEO: Inland Enforcement Officer
IMS: Intelligence Management System
IRCC: Immigration, Refugees and Citizenship Canada
IRPA: Immigration and Refugee Protection Act
MD: Ministerial Direction on Surveillance and Confidential Human Sources
NHQ: National Headquarters
NSICOP: National Security and Intelligence Committee of Parliamentarians
NSIRA: National Security and Intelligence Review Agency
PAC: Pacific Region
PRRA: Pre-Removal Risk Assessment
RAO: Risk Assessment Officer
RCMP: Royal Canadian Mounted Police
SDR: Source Debrief Report
SOP: Standard Operating Procedures
ALPR: Acknowledgement of Legal and Policy Requirements
CBS: Cloud-based solutions
CCCS: Canadian Centre for Cyber Security (Cyber Centre), part of CSE
CERT: Computer Emergency Response Team
CSIA: Cybersecurity and information assurance (aspect of CSE’s mandate; section 17 of the CSE Act)
CSE: Communications Security Establishment
CSE Act: Communications Security Establishment Act
GC: Government of Canada
GII: Global Information Infrastructure
HBS: Host-based solutions
IOC: Indicator of compromise
IRTC: Information relating to a Canadian or a person in Canada
MND: Minister of National Defence
MoU: Memorandum of Understanding
MPS: Mission Policy Suite (CSE)
NBS: Network-based solutions
NDA: National Defence Act (CSE’s lawful authority prior to the CSE Act)
OCSEC: Office of the CSE Commissioner (1996–2019)
NSICOP: National Security and Intelligence Committee of Parliamentarians
PAI: Publicly available information; see glossary.
PC: Private communication; see glossary.
PCO: Privy Council Office
NSIRA: Review of CSE’s NBS and related CSIA activities
RCP: Releasable cybersecurity product
REP: Reasonable expectation of privacy (of a Canadian or person in Canada)
RFI: Request for Information
SIGINT: Signals Intelligence
SME: Subject-Matter Expert
SOI: System of Importance (as designated by the Minister in s. 21(1) of the CSE Act)
SSC: Shared Services Canada

AELP: Attestation des exigences prévues par la loi et la politique
ARPVP: Attente raisonnable en matière de protection de la vie privée [pour un Canadien ou une personne se trouvant au Canada]
BCCST: Bureau du commissaire du Centre de la sécurité des télécommunications (1996 à 2019)
BCP: Bureau du Conseil privé
CAI: Cybersécurité et assurance de l’information (un volet du mandat du CST; article 17 de la Loi sur le CST)
CCC: Centre canadien pour la cybersécurité (Centre pour la cybersécurité), relève du CST
CP: Communication privée [voir le glossaire]
CPSNR: Comité des parlementaires sur la sécurité nationale et le renseignement
CST: Centre de la sécurité des télécommunications
DI: Demande d’information
EIUI: Équipe d’intervention d’urgence en informatique
EM: Expert en la matière
EPM: Ensemble des politiques relatives à la mission [CST]
GC: Gouvernement du Canada
IAP: Information accessible au public [voir le glossaire]
IC: Indicateur de compromission
ICPC: Information se rapportant à un Canadien ou à une personne se trouvant au Canada
IMI: Infrastructure mondiale d’information
LDN: Loi sur la défense nationale [source du pouvoir légal du CST avant la Loi sur le CST]
Loi sur le CST: Loi sur le Centre de la sécurité des télécommunications
MinDN: Ministre de la Défense nationale
PCC: Produit de cybersécurité communicable
OSSNR: Examen des SR du CST et des activités connexes en matière de CAI
PE: Protocole d’entente
SDI: Système désigné comme étant important [ainsi désigné par le ministre au titre du paragraphe 21(1) de la Loi sur le CST]
SI: Solution informatique
SIGINT: Signaux électromagnétiques [pour Signals Intelligence]
SP: Services partagés Canada
SR: Solution réseau
SSH: Solution du système hote

Introduction

The Communications Security Establishment (CSE), and the Canadian Centre for Cyber Security (CCCS, or Cyber Centre) within it, protect electronic information and information systems of Canadian federal institutions, and other systems of importance to the Government of Canada (GC).Prior to NSIRA’s creation in 2019, the Office of the CSE Commissioner (OCSEC) conducted annual reviews of CSE cyber defence activities; the most recent such review was completed in early 2019.

The Communications Security Establishment Act (CSE Act) introduced significant changes to CSE’s authorities, including in the context of the cybersecurity and information assurance aspect of its mandate (henceforth: cybersecurity aspect, or CSIA aspect). This is NSIRA’s first review of CSIA activities carried out by CSE, and the Cyber Centre therein. The review aimed to understand details of CSIA activities.

CSE uses a variety of tools, tradecraft, and services in the fulfillment of the CSIA aspect of its mandate. Prominent within CSE’s cybersecurity activities are its use of three complementary cybersecurity solutions: network-based solutions (NBS), host-based solutions (HBS), and cloud-based solutions (CBS). Information from these three solutions, alongside other information, feeds CSE intrusion detection and intrusion prevention systems. In turn, these systems enable CSE to protect the electronic information and information infrastructures of federal institutions and systems of importance to the GC.

Authority

This review was conducted pursuant to paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act.

Scope of Review

Given the use of NBS across government networks since 2006, NSIRA initially chose to focus the review on this solution specifically. However, as NSIRA learned more about CSE’s cybersecurity activities, systems, and techniques, it became clear that the initial scope was too narrow. For example, as described to the Minister by the Chief of CSE in her 2019-2020 application for Cybersecurity Activities on Federal Infrastructure, all three of CSE’s solutions are supported by three main activities: Dynamic Defence, analysis, and retention of information. NSIRA determined that while NBS provides a unique source of threat information into CSE’s cyber defence ecosystem, it was more appropriate to examine NBS in the context of CSE’s broader CSIA activities. Ultimately, this review omits an examination of host-based and cloud-based solutions. However, in its focus on NBS, the review expanded outward to CSIA activities more broadly, so long as these activities were related to NBS. For example, the second part of the Analysis section focuses on a case study pertaining to external sources of data that are used to improve how NBS functions.

The report begins with an overview of NBS and related CSE CSIA activities, including applicable legal and policy frameworks. This section makes an overarching finding about NBS and CSIA activities. Next, the Analysis section details more specific findings and recommendations, which focus on the handling of information related to a Canadian or a person in Canada (IRTC), which maybe further subject to a reasonable expectation of privacy (REP) of a Canadian or a person in Canada. The analysis comprises two themes:

Transparency about the nature of information collected by NBS; and
Acquisition of information from external sources that may contain a REP of a Canadian or person in Canada.

Annexes contain relevant contextual or supplementary information. Of note, Annex A describes the process and steps by which information captured by NBS moves through CSE’s cyber defence ecosystem, from the initial collection of this information, to the publication or sharing of reports based on analysis of this information. Annex B discusses the use of cybersecurity information across the aspects of CSE’s mandate.

Methodology

The period under review ranged from August 1, 2019 to June 17, 2021, though NSIRA received information from before and after this timeframe when deemed relevant. Notably, the specific case explored in the ‘Reasonable Expectation of Privacy’ part of the Analysis section of the report originated from activities that occurred during the period under review, but the specific case itself—and CSE’s response to it—occurred entirely after June 2021.

NSIRA analyzed a wide range of information in CSE’s possession, including extensive documentation related to: process, legal advice, technical detail, information logs, compliance reporting, and more. This included applications submitted by the Chief of CSE to the Minister for Ministerial Authorization of cybersecurity activities on federal infrastructures. Documents provided to NSIRA included correspondence between CSE and other Government of Canada entities that received, or considered the adoption of, CSE’s NBS and related cybersecurity solutions. NSIRA also received seven briefings and/or technical demonstrations from CSE subject-matter experts.

Shared Services Canada (SSC) was also scoped into the review given its role as a system owner for a large portion of GC networks. NSIRA analysed documentation from SSC and received one briefing and one technical demonstration from SSC subject-matter experts. In addition to its relevance to some of NSIRA’s areas of analysis, SSC information helped to corroborate information NSIRA received from CSE.

As per section 13 of the NSIRA Act, NSIRA cooperated with the Secretariat of the National Security and Intelligence Committee of Parliamentarians (NSICOP) to avoid unnecessary duplication of work. In this spirit, the report avoids, whenever possible, repetition of information discussed in the August 2021 NSICOP Special Report on the Government of Canada’s Framework and Activities to Defend its Systems and Networks from Cyber Attack.

Review Statements

Overall, CSE partially met NSIRA’s expectations for responsiveness on this review. While CSE partially met, or did not meet, several of NSIRA’s expectations for responsiveness during the first half of the review, CSE’s responsiveness met NSIRA’s expectations in the second half of the review. Given this was NSIRA’s first time incorporating SSC into a review, NSIRA faced initial challenges and delays in engaging SSC on this review. However, once appropriate contacts with SSC were established, SSC met NSIRA’s expectations for responsiveness.

NSIRA was able to verify information received during the review in a manner that met NSIRA’s expectations.

Overview of NBS and CSIA Activities

Finding no. 1: NSIRA found that CSE operates a comprehensive and integrated ecosystem of cybersecurity systems, tools, and capabilities to protect against cyber threats, with a design that incorporates measures meant to protect the privacy of Canadians and persons in Canada.

What is CSE’s CSIA program?

The Government of Canada views cybersecurity as “one of the most serious economic and national security challenges” facing Canada and Canadians. As described in CSE’s National Cyber Security Threat Assessment 2023-2024, the threat surface available to malicious cyber actors has expanded in recent years, and Canadians and Canadian entities remain vulnerable to cyber threats, most notably cybercrime (including ransomware), and threats from nation-state actors in the context of geopolitical competition.

The GC created the Canadian Centre for Cyber Security, within CSE, in October 2018. The Cyber Centre s creation consolidated the roles and responsibilities of CSE’s information technology security program, Public Safety Canada’s Canadian Cyber Incident Response Centre, and some of the functions of SSC’s Security Operations Centre. Today, CSE’s CSIA program provides almost all GC entities as well as applicable systems of importance a centralized and unified security operations centre running on a comprehensive suite of interconnected tools for analysis and mitigation, both manual and automated. The CSIA program, which benefits from integration with information from CSE’s foreign intelligence activities, involves the ingestion and subsequent processing of a massive volume of data from wide-ranging sources to improve threat identification and enable real-time action against threats. Compliance measures, including those meant to protect the privacy of Canadians and persons in Canada, are integrated into the data flow as cyber events are identified, and steps are taken to mitigate or remediate the corresponding threats. Annex A describes the lifecycle of information originating from NBS sensors and processed through CSE’s cyber defence ecosystem.

The CSIA program also advises government institutions, owners of systems of importance, and the public on cyber threats and cyber defence, through services ranging from published guidance to hands-on analysis and support. NSIRA’s review did not examine this component of the CSIA program.

In some cases, CSE’s CSIA solutions are used by non-GC entities outside of Canada. For example, since 2020, the United Kingdom’s National Cyber Security Centre has adopted and used CSE’s host-based solutions (HBS) to better secure U.K. government networks. [**redacted**] Although this review did not assess the efficacy of NBS or CSE’s CSIA systems and activities, NSIRA did not observe any information to suggest that they were ineffective. On the contrary, NSIRA saw specific cases where information acquired through NBS was used to respond to malicious cyber activity.

What are CCCS cybersecurity solutions?

CSE uses NBS, HBS, and CBS, often referred to as ‘sensors’, for cyber defence purposes on the information infrastructures of participating federal institutions or applicable systems of importance. CSE’s three solutions supplement commercially-available measures for detecting malicious cyberactivity, such as anti-virus and firewall software, and are used for two main functions: to identify malicious activity, and defend against it. These solutions, through both manual and automated analysis, identify anomalous behaviour and, if deemed malicious, block the same or similar activities from occurring in the future.

26. Of the three solutions, NBS was the first to be developed, in 2006, and deployed on GC networks beginning in 2009. During the period of review, CSE had deployed NBS only on GC networkinfrastructure.¹⁴ NBS captures all traffic passing into and out of a given network and sends this information to CSE through a physical ‘tap’. As a result, CSE obtains a vast amount of information, including all network traffic, emails, internet browsing information, and more.

NBS collects packets and packet data. Packets are the raw building blocks of data sent over networks, including the internet. Files can be reconstructed from packets, allowing CSE to collect emails, browsing history, or anything else transmitted to or from a network monitored by NBS. In contrast to NBS’ collection of packets, HBS collects host activity events, and CBS collects logs and content from cloud services. NBS packet collection allows CSE analysts to query for information that appears only in network data, and thus would not appear in HBS or CBS information.

There are two forms of capabilities across all three of CSE’s cyber defence solutions: passive, and dynamic.17 Passive capabilities involve sensors designed to detect, analyse, and assist in the identification of cyber threats to GC systems. In the context of NBS, sensors capture network traffic through CSE detection capabilities, regularly informed by data from both classified and unclassified sources, to identify activity of potential concern. Passive NBS, upon detecting suspicious or anomalous activity, can alert analysts for manual action or trigger automated responses.

Dynamic Defence, also referred to as ‘mitigation actions’, involves automatic action against identified malicious indicators of compromise (lOCs) that pose a threat to GC systems and networks. The automatic action comprising Dynamic Defence includes various measures, for example: detecting and preventing malicious scanning activity; blocking/filtering malicious IP addresses and domains; and detecting and blocking certain kinds of cyberattacks. Dynamic Defence leverages threat information from NBS, HBS, and CBS—as well as from [**redacted**] open sources, classified sources (e.g.: SIGINT), malware analyses, forensic investigations, and disclosures—to automatically act against malicious cyber activity without the need for intervention by human operators. Furthermore, departments—such as SSC—can request CSE to block certain lOCs. Dynamic Defence leverages techniques of machine learning, a branch of artificial intelligence, including for the recognition of malicious patterns, such as computer-generated domain-names.

As Annex A describes in further detail, CSE’s CSIA ecosystem collects extensive data, and this data moves through four main steps: collection; analysis; retention and disposal; and reporting and use. The majority of this collected data is designed to be deleted as per internal CSE data retention requirements. To retain data rather than deleting it, CSE considers the relevance, necessity, and essentiality of the data. Data which CSE has determined to retain can be used to inform cyber defences, and can be shared both inside and outside of the GC often in a way that removes personal information from the data.

To deploy NBS onto various GC networks, CSE must establish a partnership with the department or agency that owns the system. During the period of review, CSE had partnerships with federal entities for NBS (“NBS partners”, the system owners of NBS-protected networks) [**redacted**] SSC, and CSE itself. Within these [**redacted**] partnerships, some partners further extend NBS services to other GC departments and agencies whose networks are managed by the partner in question. For example, SSC managed the networks of—and thereby extended CSE NBS services to—approximately 90 GC entities, including [**redacted**]. This means that all inbound and outbound network traffic collected from all [**redacted**] of those entities is copied and transmitted to CSE. Of note, during the period of review, all CSE’s partners were clients of more sensor solutions or other CSIA services than just NBS.

Figure 1 is a CSE graphic that depicts CSE’s [**redacted**] NBS partners, including itself.

Figure 1 is a CSE graphic that depicts CSE’s NBS partners, including itself.

As mentioned above, CSE acquires, uses, and analyses cybersecurity information from the global information infrastructure (Gil) in addition to, and in order to enhance, the information originating from the tripartite solutions (HBS, NBS, CBS).24 The acquisition and use of sources of information other than from these three solutions is discussed in the Analysis section of this report(section IV).

Legal basis for cybersecurity and information assurance (CSIA) activities

The CSE Act provides authority for CSE to conduct CSIA activities and this aspect of the mandate is described in section 17 of the Act. Importantly, the CSE Act places constraints on CSIA activities; they cannot be directed at a Canadian or at any person in Canada and must not infringe the Charter of Rights and Freedoms.

CSIA activities, by their nature, are often intrusive and engage personal privacy interests. The CSE Act provides that the Minister may authorize CSIA activities that would otherwise be prohibited by subsection 22(4) of the Act. These include activities that may contravene Acts of Parliament or that would involve the acquisition by CSE of information from the Gil that interferes with a REP of a Canadian or person in Canada. In order to issue an authorization, the Minister must conclude that there are reasonable grounds to believe that any activity that would be authorized by it is reasonable and proportionate, in addition to four stipulations outlined in subsection 34(3) of the CSE Act, some of which are discussed throughout this review.

The Minister can issue two types of authorization for CSIA activities: for federal infrastructures(27(1)), and for non-federal infrastructures (27(2)). Given that NBS is deployed on GC networks, the CSIA authorizations examined as part of this review were all authorized under 27(1) rather than 27(2).An authorization issued under 27(1) authorizes CSE to “access a federal institution’s information infrastructure and acquire any information originating from, directed to, stored on or being transmitted on or through that infrastructure for the purpose of helping to protect it … from mischief, unauthorized use or disruption.”

In addition, as with authorizations issued under the foreign intelligence aspect of CSE’s mandate, CSIA authorizations are valid only once they have been approved by the IntelligenceCommissioner.

Policy framework for cybersecurity and information assurance (CSIA) activities

CSE’s internal policy framework governing activities relating to its CSIA activities is described within the Mission Policy Suite Cybersecurity (MPS Cybersecurity). Although the MPS Cybersecurity does not explicitly mention the NBS program, the document nonetheless provides overarching policy requirements for all CSIA activities, including those carried out under an authorization such as the NBS program.

For example, the MPS Cybersecurity sets out the operational policy requirements that apply to information management of data acquired from the NBS program. More specifically, the MPS provides guidance on assessing levels of sensitivity of the information, access rights to information, handling requirements for specific types of information, including assessments and tracking, as well as related retention requirements. The MPS also provides guidelines specific to engagement and information sharing with external entities. This includes engagement prior to deploying a tool or service, as well as relating to the dissemination of information acquired through cybersecurity activities. The MPS Cybersecurity also describes elements of operational compliance in the cybersecurity context.

Analysis

Transparency about the nature of NBS collection

Information related to a Canadian or a person in Canada (IRTC)

Finding no. 2: NSIRA found that CSE treated all network-based solutions (NBS) information as information related to a Canadian or a person in Canada (IRTC), and applied measures intended to protect privacy to all NBS-acquired information.

Finding no. 3: NSIRA found that information acquired through NBS will, by its nature, always include information related to a Canadian or person in Canada (IRTC) and is certain to include some information for which there is a reasonable expectation of privacy (REP) of a Canadian or person in Canada. This was not transparently communicated in corresponding applications to the Minister.

While the CSE Act mentions IRTC several times, it does not define it. According to CSE internal policy, IRTC is:

“any information recognized as having reference to a Canadian or person in Canada, regardless of whether that information could be used to identify that Canadian or person in Canada. It can include Canadian identifying information (Cll), which is any information that identifies, or could be used to identify, a Canadian or person in Canada, including entities such as corporations and other organizations… IRtC can also include information that will not necessarily lead to the identification of a Canadian or person in Canada…”.

Figure 2 (below) is a CSE graphic that depicts examples of information that may or may not be related to a Canadian or a person in Canada in an operational context. Importantly, IRTC can include (but is not limited to) information that would give rise to a REP of a Canadian or person in Canada.

CSE is permitted to incidentally acquire IRTC in the course of carrying out activities authorized under a foreign intelligence (ss. 26(1)), cybersecurity (ss. 27(1) or 27(2)), or emergency (s. 40) authorization. In order to issue an authorization, the Minister must be satisfied that CSE will only use, analyse, or retain IRTC when it meets the “essentiality” conditions in section 34 of the CSE Act, which differ for CSE’s foreign intelligence and CSIA mandate aspects. For the latter, determining “essentiality” means assessing whether the information is essential to identify, isolate, prevent or mitigate harm to (i) federal institutions’ electronic information or information infrastructures, or (ii) electronic information or information infrastructures designated under subsection 21(1) of the CSE Act (systems of importance). For foreign intelligence, “essentiality” means an assessment of whether the information is essential to international affairs, defence or security.

NBS, IRTC, and information that may interfere with a REP of a Canadian or person in Canada

From 2019-2021, CSE produced 1103 releasable cybersecurity products (RCPs) with NBS information that contained IRTC. CSE told NSIRA that it does not share reports beyond the system owner implicated in the report, unless permission is granted by said system owner. As such, each report identifies only one department and removes identities of departments other than the intended recipient.

CSE’s applications for federal cybersecurity activities, as well as the Minister’s corresponding authorizations, state multiple times that HBS, NBS, and CBS are not directed at Canadians or persons in Canada, and that any IRTC that may be acquired through these solutions—including information that may interfere with a REP of a Canadian or person in Canada—is acquired incidentally. CSE, drawing on paragraph 23(3)(a) of the CSE Act, takes the position that “Since the coming into effect of the CSE Act, the conduct of cybersecurity activities on a network for the purposes of helping to defend it is not considered “directed at”. This is because the intent and purpose of NBS acquisition is not IRTC, but rather “whether any acquired information indicates a potential cyber incident or cyber threat.”

In the CSE Chiefs 2019-2020 application to the Minister, for cybersecurity activities on federal infrastructure, the Chief notes that “While conducting cybersecurity activities, emails that may contain information relating to Canadian or person in Canada will be incidentally acquired and copied.” The corresponding authorization states, in paragraph 2(f)(i) that CSE’s acquisition of IRTC in the course of cybersecurity activities is “unavoidable.”

However, language in all three subsequent annual applications for cybersecurity activities on federal infrastructure from 2020 to time of writing in May 2023 were considerably more ambiguous about the degree to which IRTC may be acquired by the activities. For example, the applications state on multiple occasions that CSE “may incidentally acquire [IRTC]” or that in the context of the authorization, CSE “may undertake activities that could include the incidental acquisition of [IRTC].”

All information collected by NBS is “assumed to contain IRTC”. This assumption is based on CSE’s position that “Given that NBS data is collected from Canadian infrastructure, it is by nature information related to Canadians.” Since 2020, the applications to the Minister for authorization under ss. 27(1) of the CSE Act do not clearly convey the extent of this collection.

CSE acquires communications content through NBS, including the content of emails sent by non-GC email addresses to GC email addresses, and vice-versa. Given the nature of this acquisition, some of the information acquired by CSE is certain to contain information that interferes with the REP of a Canadian or person in Canada. Yet CSE’s authorizations and corresponding applications do not fully reflect this reality. Instead, the authorizations include language stating that the acquisition of information “presents a risk that CSE may interfere with the [REP]”, and the corresponding application informs the Minister that ‘CSE runs the risk that it may” acquire information that interferes with a REP when engaged in the described CSIA activities. The corresponding applications include similar conditional language. In reality, NBS is certain to acquire information for which there is a REP for a Canadian or person in Canada.

One significant change introduced by the CSE Act is the entrenchment of the concepts of IRTC, and REP. This is a change from the privacy provisions—including “private communication”(PC)—found in CSE’s previous statutory home in Part V.1 of the National Defence Act. This change reflects the development and increasing sophistication of legal privacy concepts.

As per section 24 of the CSE Act, CSE must ensure that measures are in place to protect the privacy of Canadians and persons in Canada in the use, analysis, retention, and disclosure of information; some of these measures are described in Annex A. CSE stated that it is “developing a series of Privacy Impact Assessments that examine the creation, collection, and handling of personal information within the Cyber Security program”, though these were not ready during the review period.

The fact that NBS collection from Canadian federal infrastructures is, by its nature, certain to include IRTC—including information that interferes with the REP of a Canadian or person in Canada—is neither surprising nor novel. It would not be possible to conduct effective cybersecurity activities of federal institutions’ electronic infrastructure and information infrastructures without collecting information in this manner. Regardless, the Minister should receive dear and accurate information about this fact prior to the authorization, given the risks to privacy interests of Canadians.

Recommendation no.1: NSIRA recommends that CSE dearly explain, in its applications to the Minister, that:

Network-based solutions acquire information relating to a Canadian or a person in Canada (IRTC), including information that interferes with the reasonable expectation of privacy (REP) of Canadians or persons in Canada; and,

CSE subsequently uses, analyses, and retains this information for use in cybersecurity and information assurance activities.

Consent to CSE’s cybersecurity solutions

As per paragraph 34(3)(b) of the CSE Act, one condition for the Minister to issue a cybersecurity authorization for federal infrastructures (27(1) of the CSE Act) is that there are reasonable grounds to believe that the consent of all persons whose information may be acquired could not be reasonably obtained. In the case of a cybersecurity authorization for non-federal infrastructures (27(2) of the CSE Act), CSE must obtain a written request of the given infrastructure owner or operator asking CSE to carry out the authorized activity.

As of May 2023, all authorizations since 2019 for cybersecurity activities on federal infrastructures included the following statement:

“In accordance with standard government practice, federal institutions must advise authorized users of these information infrastructures that their device and/or network activity are being monitored for cybersecurity and information assurance purposes.”

This statement aligns with provisions set out in GC documents such as the Treasury Board Policy on Service and Digital. According to the Policy on Service and Digital, deputy heads of departments are responsible for informing authorized users of departmental electronic networks and devices of “Monitoring practices being applied by their own department and by SSC’’, among other responsibilities.

Transparency toward, and cooperation with, system owners

Finding no. 4: NSIRA found that, due to a lack of clarity in its relationship with SSC, CSE did not obtain consent from system owners for its cybersecurity and information assurance activities in the way described to the Minister.

Finding no. 5: NSIRA found that SSC was not fully aware of its responsibilities as a system owner, as described in CSE’s applications to the Minister.

Finding no. 6: NSIRA found that, despite the existence of a Memorandum of Understanding between CSE and SSC, there was a lack of clarity between the organizations on the implementation of agreed-upon commitments about NBS activities on networks operated by SSC.

The Chiefs 2019-2020 and 2020-2021 applications to the Minister, for cybersecurity activities on federal infrastructures, state that “CSE deploys its HBS, NBS, and CBS capabilities only with the informed consent of the system owner of the federal institution’s information infrastructure.” The subsequent two applications for cybersecurity activities on federal infrastructures—2021-2022 and2022-2023—did not include the word ‘informed’ in this context.

While CSE obtains the consent of the NBS partner for NBS deployment, this does not usually include the specific departments or agencies linked to that network. For instance, SSC’s Internet Interconnectivity Service (IIS) network had approximately 90 GC departments or agencies connected to it during the period of review, yet CSE’s partnership was solely with SSC (system owner for the IIS network), rather than the various entities connected to SSC’s IIS network. As such, SSC acts as a consent broker for the various departments or agencies connected to its network.

Collaboration between CSE and SSC on NBS is longstanding. According to CSE, SSC is “actively involved with CSE on a variety of levels related to [the] NBS program”, and SSC “is fully briefed on the NBS program”, both upon initial deployment and through various formats and operational interactions. SSC, toward the end of the review, told NSIRA that “SSC has a solid understanding of the role that CSE plays in protecting and monitoring the Government of Canada network.” SSC further stated that it trusts that “CSE provides SSC with the necessary information to enable SSC to respond to incidents and events effectively”, while also emphasizing a strong relationship and “track record of timely and appropriate interventions.” Nevertheless, in briefings and written responses over the course of the review, SSC indicated that it views NBS and the workings of CSE’s cybersecurity sensors as “black boxes’’. SSC also stated during the review that it is not provided with explanation about CSE cyber defence processes, procedure, risk, or technical information related to tools or services. Of note, SSC maintains its own suite of firewalls, in addition to the protection offered by CSE’s CSIA program. While layering protections is a common cyber security practice, SSC’s lack of visibility into CSE’s defences could contribute to operational inefficiencies. For example, SSC described being unable at times to quickly attribute an apparent blocking action or unexpected network behaviour.

SSC further confirmed that it “does not have a specific process for advising departments of the NBS program”, other than onboarding packages which “may contain boilerplate statements regarding the fact that systems are monitored for security purposes and that there is no presumption of privacy while working on a government system”. SSC’s practice in this case does not reflect what CSE described to the Minister in its applications for authorizations. Moreover, this does not align with SSC’s responsibility per a March 2014 Memorandum of Understanding (MoU) between CSE and SSC, where it is agreed that SSC will inform its clients that “CSE may acquire their data, including personal information and/or private communications, while conducting cyber defence activities for SSC.

CSE made assurances to the Minister through the Chief’s application that CSE obtains system owners’ consent to cybersecurity sensors, including NBS. In reality, SSC was broadly unaware of how CSE’s cybersecurity activities operate, and SSC in turn did not—and was not able to—adequately inform clients that CSE may acquire their information in the course of CSE’s authorized cyber security activities, including the collection and retention of personal information and the content of communications. During the factual accuracy consultation for this report, CSE noted that this report “is the first time that CSE has been informed that SSC is not aware of its responsibilities as a system owner.”

The 2014 MoU between CSE and SSC sets out the terms and conditions under which CSE’s cyber defence activities were conducted on systems and networks under SSC control. The MoU stipulates that SSC will “Ensure that SSC clients have been informed that CSE may acquire their data, including personal information and/or private communications, while conducting cyber defence activities for SSC.” In turn, the MoU states that CSE will provide SSC with details about processes, procedure, technical information related to tools or services, and risks, prior to deployment on SSC networks or systems.

However, SSC initially stated during the review that the 2014 MoU was no longer in force, having been replaced by a 2018 MoU in support of the creation of the Cyber Centre and related transfer of resources. Yet the 2018 MoU pertains to organizational and financial considerations and does not make substantive mention of CSE’s cyber defence sensors or how they operate. The lack of information about CSE’s cyber defence activities in the 2014 MoU stands in contrast to MoU’s received by NSIRA [**redacted**] for provided more substantive information about CSE cyber defence activities, including authorities and descriptions of the types of activities to be undertaken.

In addition to SSC, other MoUs between CSE and its cyber defence partners date from before the CSE Act. For example, the most recent MoUs for NBS services, received by NSIRA during this between As per of the CSE Act, CSE’s MoUs established prior to the CSE Act continued in accordance with their terms after the coming-into-force of the CSE Act, and CSE confirmed its view that this was the case for the SSC MoU.

During the factual accuracy consultation at the final stages of the review, SSC informed NSIRA that contrary to its initial statements the 2014 MoU with CSE remained in effect. SSC further stated that ft will “continue to work with CSE to ensure that the expectations outlined in the2014 MoU remain aligned with updated Government of Canada policies.”

Recommendation no. 2: NSIRA recommends that CSE renew its Memorandum of Understanding with SSC to ensure CSE and SSC meet their respective commitments, including any that CSE makes to the Minister regarding SSC’s role in informing system owners about the NBS program.

Recommendation no. 3: NSIRA recommends that CSE update Memoranda of Understanding with all of its cybersecurity partners, to ensure these partners have consented to CSE cybersecurity activities, and to ensure these arrangements reflect, and conform to, contemporary governance authorities. CSE should continue these updates, as a standard practice, as authorities evolve.

Transparency toward system users

Finding no. 7: NSIRA found that CSE did not explain to the Minister why consent to CSE’s cybersecurity activities could not reasonably be obtained from users of Government of Canada systems.

Broadly speaking, there are two groups who use GC systems: non-GC users (e.g.: the public, or those outside of the GC interacting with the GC), and GC users (e.g.: employees of GC institutions). For the first group, CSE adequately explains to the Minister, per paragraph 34(3)(b) of the CSE Act, why their consent cannot reasonably be obtained. However, there is no explanation to the Minister of either why consent cannot be obtained, or how consent is obtained, from users of GC systems (e.g., GC employees). This is despite the requirement in paragraph 34(3)(b) that the Minister must have reasonable grounds to believe consent of all persons whose information may be acquired could not reasonably be obtained.

There is no explicit legal requirement for CSE to inform users of GC systems that it acquires information from those systems pursuant to a cybersecurity authorization. CSE could explain to the Minister that it cannot reasonably obtain consent from these users. Instead of providing such an explanation. CSE’s position to the Minister is that respective federal institutions are responsible for advising authorized users of GC information infrastructures that their devices or network activity are monitored for CSIA purposes.

63. In lieu of obtaining consent of all persons whose information may be acquired, it is important that appropriate notice be provided—particularly to the primary users of GC systems such as GC employees—that CSE may acquire and use information from those systems for cybersecurity purposes. CSE told NSIRA that consent is obtained from users of GC systems through a notification to these users that their device and/or network activity are being monitored for cybersecurity and information assurance purposes. CSE further stated that when a user acknowledges the notification by clicking an acceptance button, this demonstrates the user’s consent. NSIRA did not verify the content of this notification, nor whether it is shown to all users of GC systems. SSC, for its part, took issue with the notion of consent in this context, pointing out that the Treasury Board policy requiring these notices “is focused on notification rather than consent”

Recommendation no. 4: NSIRA recommends that CSE explain to the Minister how consent to CSE’s cybersecurity activities is obtained from users of Government of Canada systems, or otherwise explain why this consent could not reasonably be obtained.

Information from external sources for which there is a Reasonable Expectation of Privacy (REP) of a Canadian or person in Canada

Section 17 of the CSE Act allows CSE to acquire, use, and analyse information from the Gil or from other sources in order to provide advice, guidance and services to help it protect both federal institutions’ electronic information and information infrastructure, and electronic information and information infrastructures designated as being of importance to the Government of Canada (Systems of Importance, or SOls). For example, CSE can acquire, use, and analyse publicly available information (PAI), defined in the Act as “information that has been published or broadcast for public consumption, is accessible to the public on the global information infrastructure or otherwise is available to the public on request, by subscription or by purchase.” Importantly, PAI does not include information in respect of which a Canadian or person in Canada has a reasonable expectation of privacy.

As per paragraph 23(1Ra) of the CSE Act, CSE is permitted to acquire and use PAI without seeking an authorization. If the acquired PAI contains IRTC, paragraph 24(a) of the CSE Act requires CSE to implement measures to protect privacy when using, analysing, retaining, or disclosing information acquired while conducting activities under its foreign intelligence or cybersecurity aspects of its mandate. Some of these measures are described in Annex A.

A limit is applied to CSIA activities in subsection 22(4), which prohibits CSE from acquiring information from the GII in a way that contravenes any Act of Parliament or interferes with the reasonable expectation of privacy of a Canadian or person in Canada. For CSIA activities, CSE can only acquire information in this way if the acquisition is conducted under a Ministerial authorization issued in accordance with subsections 27(1) or (2) of the CSE Act. As such, CSE cybersecurity activities that risk interfering with a reasonable expectation of privacy of a Canadian or person in Canada can only be authorized on federal information infrastructures and systems designated as important to the Government of Canada.

Risk of acquiring information that contains a REP in sources of cybersecurity information outside of an authorization

Finding no. 8: NSIRA found that CSE’s narrow application of subsection 22(4) of the CSE Act introduces legal and accountability risks and, in at least one instance, resulted in CSE acquiring information that may interfere with a reasonable expectation of privacy of a Canadian or person in Canada. This information was from a source acquired outside of the scheme of Ministerial authorizations.

Finding no. 9: NSIRA found that an incongruence between subsections 27(1) and 22(4) of the CSE Act prevents CSE from acquiring certain information from external sources such as commercial databases, where this information interferes with the reasonable expectation of privacy of a Canadian or person in Canada. Some of this information would enhance CSE’s ability to fulfill its cybersecurity and information assurance mandate.

In addition to the tripartite sensors, CSE’s cybersecurity information is complemented by information from SIGINT, disclosures, agreements, and other publicly-available sources like commercial and open sources, including information and databases aggregated by data brokers. CSE provided NSIRA with a list of [**redacted**] external sources (other than CSE sensors or SIGINT sources) that yielded information used by CSE for activities related to federal cybersecurity authorizations during the review period. [**redacted**] this type of information is a common practice for cybersecurity, as it allows the gathering of information from [**redacted**]

These sources yield information from portions of the GII other than what CSE can access under subsection 27(1) and (2) authorizations. This is visualized in Figure 3.

Figure 3: GII, and subsections 27(1) and (2) of the CSE Act:

Beginning in 2020-2021, the Chiefs applications for federal cybersecurity authorizations mention that CSE combines cyber threat information from federal institutions with sources as described above, including publicly available information. Shortly thereafter, in early 2021, CSE initiated internal discussion between its operational, compliance, and legal groups about questions raised regarding open source information that had a potential to infringe on a REP of a Canadian or person in Canada, in the context of acquisition for foreign intelligence (s. 16) activities.

CSE takes the position that the CSE Act “does not distinguish between a lower, or higher, reasonable expectation of privacy.” In other words, regardless of the degree to which, or likelihood that, a REP might be interfered with, and regardless of the mandate aspect under which the REP might be interfered with, CSE nevertheless requires an authorization as per subsections 22(3) and 22(4) of the CSE Act if there is even a low risk of REP in information being acquired.

In CSE’s application per subsection 27(1) for the 2022-2023 Cybersecurity Authorization for Activities on Federal Infrastructures, CSE noted for the first time that CSE sought to acquire cybersecurity information from third party providers (external sources) which “may have a low risk of interfering with the reasonable expectation of privacy of a Canadian or person in Canada.” The application states that this issue was recently recognized by CSE.

CSE’s application to the Minister stated that “When CSE encounters this information [**redacted**] it is arguable that this activity does not need to take place under an Authorization as CSE is not directly acquiring information from the GII.” CSE developed this view based on the [**redacted**] rationale that there are “strong arguments” that searches [**redacted**] “would not constitute an acquisition by CSE of information with an REP from the [GII]”. [**redacted**] still recommended that CSE “list these activities as an acquisition technique in an authorization,” even while recognizing that the cybersecurity authorization regime as per the CSE Act cannot be applied to this CSE activity. Ultimately, as mentioned, CSE listed the activities as an acquisition technique in its application to the Minister.

After the Minister issued the authorization based on this application, and it was sent to the Intelligence Commissioner (IC) for approval, the IC did not approve the portion of the authorization pertaining to the acquisition of information from external sources which may interfere with the REP of a Canadian or person in Canada The IC concluded that there was no rationale or information provided by CSE to the Minister to explain how the acquisition of information from third parties, that risked interfering with a REP, could be authorized by subsection 27(1). The IC commented that “The language of subsection 27(1) does not, prima facie (at first view), contemplate or permit the issuance of an authorization outside the scope of accessing a federal institution’s information infrastructure.’6364NSIRA further notes that the acquisition in question could not, also, be covered under a subsection27(2) authorization. The CSE Act, as drafted, limits CSE’s CSIA activities on most of the Gil—other than federal information infrastructures and SOIs—to activities that do not require an authorization.

Table 1, below, provides a timeline of events pertaining to this issue:

Date	Event
September 2, 2020	Cyber Centre [redacted]
March 29, 2021	A CSE group [redacted]
May 26, 2022	Chief CSE signs 2022-2023 application for cybersecurity activities on federal infrastructures, which contains new language about acquiring information from the GIH that may risk interfering with the REP of a Canadian or person in Canada.
June 1, 2022	Minister of National Defence issues the 2022-2023 authorization, per ss. 27(1) of the CSE Act” activities on federal infrastructures, which contains new language about acquiring information from the Gil that may risk interfering with a REP.
June 9, 2022	[redacted]
June 27, 2022	Intelligence Commissioner approves the 2022-2023 application for cyber security activities on federal infrastructures, except for the section of the application about acquiring information from the GII that may risk interfering with a REP.

Despite the IC decision to not approve the section of the Ministerial authorization pertaining to acquisition of cybersecurity information from external sources which may interfere with the REP of a Canadian or person in Canada, CSE nevertheless continued to acquire information from third partysources.65 CSE continued the acquisition of information from these sources based on CSE’s view that the information was not an acquisition by CSE of information from the GII—and thus CSE’s ingestion was not, under this view, prohibited by subsection 22(4) of the CSE Act.66-67 The decision to continue to acquire this external information outside of an authorization after the IC did not approve those same activities is concerning—especially in light of the nature of at least one of these sources, as discussed below.

NSIRA’s investigation into this issue began at a time when CSE was also examining the matter; information thus evolved as CSE determined its approach. In November 2022, CSE stated that it was assessing the privacy considerations of information used for CSIA activities from sources other than CSE sensors, including assessments of the degree to which there may be a REP in this information. According to CSE;

“Where a source was [**redacted**] [CSE is] developing a framework to understand the potential implications for REP, noting that the information in these cases [**redacted**] In cases where CSE directly acquired the information and the information may contain IRtC, techniques are being developed to prevent the collection of IRtC and subsequently any interference with REP.”

CSE also acknowledged that “REP is expected to evolve over time both through case law and use cases”, and that CSE “will continue to monitor, learn and adjust accordingly.” Furthermore:

“The Authorities, Compliance and Transparency branch (ACT) has been working internally [**redacted**] to catalogue incoming data sources used by the Cyber Centre to determine types of data, where the data comes from (i.e.: GII or not), and how Cyber Centre acquires it ( [**redacted**] disclosure or other means) … Based on this information, ACT, [**redacted**] worked to evaluate these sources as to whether the data source might contain IRtC. In general, the information in these [**redacted**] is technical in nature and would present a low-risk to REP.”

CSE later stated, in May 2023, that identifying a framework for assessing or defining REP was difficult, in part due to a lack of jurisprudence on REP in a cyber context. Instead, in practice, operators had been issued guidance such that if they identify changes in their [**redacted**] information sources, the operators are to consult with CSE’s internal compliance unit. CSE further explained that, while information collected from the GII which could potentially interfere with the REP of a Canadian or person in Canada was within CSE’s holdings prior to being recognized and disposed of, the same privacy mitigation measures that it applies to all IRTC would also be applied—on a case-by-case basis—to any information that interferes with a REP if discovered by analysts. CSE noted that, in cases where information that interferes with a REP is identified in CSE’s holdings, it is deleted. As of mid-2023, CSE Operational Policy was working to develop a framework to help provide additional guidance for operators related to open source acquisition. CSE also told NSIRA that it conducts due diligence to ensure that [**redacted**] are “reputable” and operating lawfully, though CSE was unable to clearly articulate nor provide specific examples of how this had been, or would be, done.

CSE’s internal compliance unit, which was directly engaged on this issue, conducted (interalia) a categorization exercise’ that examined the [**redacted**] external sources of cybersecurity information for whether those sources constituted an acquisition by CSE of information from the GII.69 CSE’s categorization exercise proceeded “based on the understanding that information lawfully acquired [**redacted**] then obtained by CSE [**redacted**] in support of CSE’s mandate, would not be considered an acquisition from the GII by CSE as set out in the CSE Act, and could therefore be acquired without consideration of a Ministerial Authorization.”70 CSE concluded that all but [**redacted**] of the [**redacted**] external sources were not acquired by CSE from the GII. Importantly, as a result, CSE did not formally examine whether the [**redacted**] sources contained information that risked interfering with the REP of a Canadian or person in Canada, despite confirming that at least one of these sources included information that risked doing so. Put plainly, CSE’s approach was to address questions pertaining to REP in this context after information that might interfere with a REP was identified as being in CSE’s holdings, rather than proactively.

NSIRA examined some of the [**redacted**] external sources of cybersecurity information (sources not covered by a Ministerial authorization). In particular, NSIRA focused on[**redacted**] CSE acquires information from [**redacted**] in various forms, including threat reports, IOC [**redacted**] and searchable datasets. Given the nature of this information, it is likely that some of this information interfere with a REP of a Canadian or person in Canada—including information other than GC information.

After CSE’s categorization exercise, CSE ultimately decided that in this specific case its “querying into [**redacted**] datasets and extracting information is akin to an acquisition by CSE from the GH”, but that measures can and are being taken to prevent the acquisition of information from those datasets that might interfere with the REP of a Canadian or person in Canada. In CSE’s view, so long as these measures are in place, and the information being acquired does not interfere with the REP of a Canadian or person in Canada, CSE can continue that acquisition without a Ministerial authorization. Given CSE’s approach to address REP information once it is identified in CSE’s holdings, it is possible that that CSE could acquire information that interferes with the REP of a Canadian or person in Canada, outside of an authorization, despite the prohibition in subsection 22(4) of the CSE Act.

More broadly, CSE’s general conclusion that acquisition of information from external sources—for example, [**redacted**] —does not constitute an acquisition by CSE of information from the GII raises questions. Per section 2 of the CSE Act, the Gil is defined broadly to include “electromagnetic emissions… communications systems, information technology systems and networks, and any data or technical information carried on, contained in or relating to those emissions, that equipment, those systems, or those networks.” Intuitively, actively seeking information—for example [**redacted**] —could appear akin to an acquisition. CSE’s position, that its ingestion of information from such external sources does not constitute an acquisition from the GII, is thus tenuous and may introduce risk.

The acquisition of cybersecurity information sources outside of Ministerial authorizations that do not risk interfering with the REP of a Canadian or person in Canada nor contravene an Act of Parliament, does not pose compliance concerns. However, CSE’s current practice of not assessing information sources for potential interference with a REP prior to their acquisition introduces the risk that CSE could retain unassessed data containing information subject to a REP—ingested outside of a legislative scheme—indefinitely. Parliament contemplated that it would be necessary for CSE to acquire, use and retain this type of REP-containing information in the course of CSE’s CSIA activities; the CSE Act ss. 22(4) prohibits this acquisition, use, and retention unless these are first authorized by the Minister and approved by the IC. This Ministerial accountability regime is thus central to the underlying lawfulness of these CSIA activities. Yet CSE’s narrow interpretation of ss. 22(4) excludes some of these intrusive and extraordinary activities from this regime. Furthermore, CSE did not specify whether its interpretation of the larger provisions rests on a particular interpretation of the term “acquisition”, or “Global information infrastructure”. This raises questions as to whether the interpretation of this prohibition, and the individual terms within it, will impact activities in other aspects of CSE’s mandate.

In addition to the 2022 Intelligence Commissioner decision on the Ministerial authorization for CSIA activities on federal systems, a subsequent 2023 IC decision on the corresponding authorization for the 2023-2024 period examined the 2022 decision, and evaluated the Ministerial authorization scheme applicable to CSIA activities more generally.71 The two IC decisions, in addition to the facts as described in this report, demonstrate—in effect—that the CSIA activities which may be authorized in accordance with ss. 27(1) are more limited than the activities prohibited by ss. 22(4). The 27(1) authorization is limited by the links to “federal institution’s information infrastructure.” In contrast, the respective analogous statutory prohibition and Ministerial authorization(s) applicable to the foreign intelligence aspect of CSE’s mandate appear symmetrical. In other words, in the case of foreign intelligence, activities prohibited under ss. 22(3) may be authorized by the Minister under s. 26.

The incongruence between ss. 22(4) and 27(1) appears to limit activities, such as the acquisition of certain information from external sources, which would support the CSIA aspect of CSE’s mandate and would not otherwise be precluded by the Act. In an April 2023 document provided to the Minister and the Intelligence Commissioner, the Chief of CSE characterized this incongruity as a “legislative drafting oversight.”

Recommendation no. 5: NSIRA recommends that CSE reconsider whether limits on the acquisition by CSE of information from the global internet infrastructure (as per subsection 22(4) of the CSE Act) apply to information from third-party data sources. This should include an assessment of whether section 8 of the Charter of Rights and Freedoms may be engaged, as well as cases where third-party data sources may contain information that interferes with the reasonable expectation of privacy of a Canadian or person in Canada.

Recommendation no. 6: NSIRA recommends that, in order to continue these acquisition activities that are necessary for cybersecurity and information assurance (CSIA) purposes, CSE assess its current sources of CSIA information—that are acquired outside of an Authorization—for interference with the reasonable expectation of privacy of a Canadian or person in Canada. This assessment should be repeated as required to ensure such information is not acquired without a valid Ministerial authorization

Recommendation no. 7: NSIRA recommends that section 27 of the CSE Act be amended to permit the Minister to authorize CSE to acquire information that is necessary for CSE’s cybersecurity and information assurance aspect (but which may contain information that interferes with the reasonable expectation of privacy of a Canadian or person in Canada, or contravene an Act of Parliament), from sources other than federal information infrastructures and systems of importance to the Government of Canada.

CONCLUSION

CSE, and the Canadian Centre for Cyber Security within it, operate a comprehensive and integrated ecosystem of cybersecurity systems, tools, and capabilities. This ecosystem protects the electronic information and information infrastructures of Canadian federal institutions and applicable infrastructures deemed important to the Government of Canada, with a design that incorporates measures meant to protect the privacy of Canadians and persons in Canada.

In the context of NSIRA’s review mandate it is particularly salient that NBS sensors, and related activities under the. CSIA program, are certain to acquire information related to Canadians or persons in Canada, including information that interferes with the reasonable expectation of privacy of a Canadian or a person in Canada. NSIRA made findings and recommendations in two main thematic areas: transparency to the Minister about the nature of elements of some NBS-related activities, and as specific issue with regard to an information acquisition activity from external sources, which CSE continued to conduct even after this activity was not approved by the Intelligence Commissioner.

In the latter case, the issue resulted from an incongruence in CSE’s legislation that appears to limit the ability for an authorization to be issued under the CSIA aspect of CSE’s mandate for the acquisition activity, despite the important value of information from this acquisition to CSE’s ability to protect electronic information and information infrastructures.

NSIRA continued to face challenges from CSE regarding timeliness and access to information during the first half of the review, though was satisfied with CSE timeliness and access in the second half of the review. Despite continuing discussions with CSE on required improvements to NSIRA’s access to CSE information, NSIRA was able to verify information received during the review in a manner that met NSIRA’s expectations.

The information examined by NSIRA during this review also supported NSIRA’s internal knowledge-building about CSE; this foundation will enable more specific review focuses in the future.

ANNEX A: Lifecycle of Information

This Annex describes how information travels through CSE’s cyber defence ecosystem, beginning with initial collection—in this case through network-based sensors—through to the publication or sharing of reporting based on that information. Some information in this section may be current only as of the end of NSIRA’s review period (June 17, 2021).

CSE’s CSIA ecosystem collects extensive data, including network packets, host activity events, and logs. This data moves through four main steps: (1) collection; (2) analysis; (3) retention and disposal; and (4) reporting and use. The data moves through different networks in these steps, from unclassified partner networks to CSE networks. Each step involves multiple technical systems, operating either automatically or under the direction of human analysts. The processing and analysis of cybersecurity data is not specific to a given sensor program or source of information; steps 2-4apply to all sources of cybersecurity data. Throughout these various steps, CSE has implemented various measures to protect the privacy of Canadians and persons in Canada, including assessments for relevance, necessity, and/or essentiality, access control to sensitive information, retention limits, and automation.73 Although NSIRA did not examine all of these measures nor fully verify the details of their implementation, some of these measures are described in this section.

Collection

The data on which CSE’s CSIA systems operate is collected directly, through the [**redacted**] of [**redacted**] NBS, cloud-based solutions (CBS) and host-based solutions (HBS). A copy of the data is sent to processing systems on both CSE’s classified and unclassified networks. When received by CSEs systems, all collected data is considered unassessed, described by CSE and in this section as “raw”.

The raw data is copied and sent through several different systems for processing. [**redacted**]

At this stage, the processed data is still considered unassessed, as it has only been processed by automated processes, not yet viewed by an analyst.

Analysis

CSE cybersecurity analysts use various tools to access cyber defence data. These tools can search extracted metadata based on different criteria, and can be run manually or automatically, on a defined schedule, via scripts written by analysts. From these tools, analysts can access the raw data [**redacted**]

In addition to the tripartite sensors, CSE’s cybersecurity information is complemented by information from SIGINT, disclosures,75 agreements, and other publicly-available sources like [**redacted**] open sources. Analysts can query these [**redacted**] sources, manually or automatically, in combination with raw data collected by CSE sensors, to produce mitigation actions and reporting.

When an analyst identifies data that meets CSE policy thresholds for use, analysis, or retention, they retain it in CSE’s cyber defence knowledgebase. To be retained, NBS data must meet CSE’s threshold of essentiality (discussed further in the section on retention and disposal), due to CSE’s assumption that all NBS data includes IRTC. Analysts must tag data to explain why it is being retained, choosing from one of three possible options. Data can be retained because it: [**redacted**]

Given the amount and sensitivity of the information available through the various analysis tools, access is limited to CSE staff that have completed the annual Acknowledgement of Legal and Policy Requirements (ALPR) training and test. Various actions in the system are logged (for example, all queries to access processed data are logged and retained for [**redacted**] to enable auditing.

In some cases, automated processes assess data on behalf of analysts, for example in Assembly line, a malware analysis tool built by CSE. Assembly line performs static and dynamic analysis of files, including email attachments, to identify malware or other malicious content. It analyses all extracted files automatically, and alerts analysts of files suspected to be malicious. Analysts can then use an interface to review the potentially malicious files, extracting and retaining data if appropriate. Analysts can also automate the identification of malicious files by creating filters in Assembly line. Filters identify files with certain characteristics, then deem any future files with the same characteristics as malicious, automatically retaining the data.

Retention and disposal

Raw data must, according to CSE policy, be deleted [**redacted**] of acquisition”. Though precise timing differs by system, most raw data is deleted much sooner than [**redacted**] after acquisition.

Files processed by Asseblyline have a [**redacted**] approach to retention: [**redacted**].

CSE has different standards for data retention, depending on its sensitivity, escalating from relevance through necessity to essentiality:

Relevance: “Information that can be used to help protect federal systems or [systemsof importance] and the electronic information they contain.”
Necessity: Information which is “required for the understanding of malicious cyber activities”, but without which CSE can still identify, isolate, prevent, or mitigate harm.
Essentiality: Information without which CSE cannot identify, isolate, prevent, or mitigate harm.

In the case of data acquired by NBS, CSE treats all of the information as IRTC. In this case, the policy standard for retention is essentiality, and analysts retaining data must justify its retention at that standard. This is met, as previously noted, by selecting one of three reasons: malicious activity, situational awareness, or capability development. These are retained according to corporate retention requirements, either deleted or transferred to Library and Archives Canada after 10-30years, depending on their nature.

The treatment of all NBS information as IRTC also has implications for disclosure. According to CSE, because any IRTC that has been retained by CSE has already been deemed as “essential”, this IRTC can be disclosed so long as it is “necessary” to do so. CSE considers this to be a “double” threshold of essentiality and necessity when IRTC is obtained under authorization.

At this stage, data in the knowledgebase is considered assessed, as it has been processed either directly by an analyst or indirectly, according to rules created by an analyst. It can then be used for cyber defence outputs, whether reporting or defensive actions.

Reporting and use

When an analyst, or automated tradecraft operating from analyst instruction, identifies a threat based on cyber defence data (e.g., [**redacted**]), they can generate a tasking for the Dynamic Defence system. This tasking will then be applied [**redacted**]. GC departments receiving cyber defence services from CSE can access limited information about mitigation rules applied to their infrastructure.

Reporting can take a variety of forms, from unclassified indicators of compromise (lOCs),including malicious IP addresses or domain names, to more substantial releasable cyber security products, such as incident reports [**redacted**].

Report development begins on the classified network. A report can simply consist of [**redacted**] Managers verify the analysis, confirming, for example, that all supporting evidence for a report was retained. With sanitization and approval, reports can be transferred to unclassified networks for dissemination beyond CSE.
Approved reports, depending on their nature and content, can be disseminated manually to a variety of partners, including: Five Eyes [**redacted**] GC departments; Canadian critical infrastructure organizations.
lOCs can be disseminated automatically to the same partners. lOCs are exchanged innear real-time through Aventail, [**redacted**]

Under the CSIA aspect of its mandate, CSE shares information extensively, both internally and externally to the GC—provided that the information is relevant to CSE’s CSIA aspects, and it is essential to share this information with another entity. In the case of IRTC, this sharing is enabled by Ministerial Order, which authorizes CSE to share IRTC acquired through its CSIA aspect to persons or classes of recipients designated by the Minister. IRTC is generally disclosed only to the system owner of an affected system for victim notification (e.g., to identify an infected computer).

CSE told NSIRA that it removes “any personal information”, i.e.: Canadian Identifying Information, IRTC, and private communications, from reporting before it is shared with any partner, though CSE later told NSIRA that this may not always be the case when [**redacted**]. NSIRA viewed some examples of CSE’s removal (suppression) of personal information in viewing different kinds of cybersecurity reports, including during a technical demonstration. CSE may disseminate reports containing non-IRTC information to a broader audience, as is the case when sharing loCs through AVENTAIL to private and public sector entities.

In accordance with a Ministerial Order under s. 45 of the CSE Act, other entities inside and outside of Canada, including but not limited to Five Eyes entities, can receive unsuppressed IRTC information from CSE. In these cases, IRTC is shared in the form of releasable cybersecurity products. Per CSE internal policy, as well as the Avoiding Complicity in Mistreatment by Foreign Entities Act, CSE must conduct a mistreatment risk assessment when it shares information with foreign nations that could identify an individual, either directly or indirectly. NSIRA did not closely examine this or other topics related to the disclosure of cybersecurity information outside of CSE

ANNEX B: Cross-aspect use of cybersecurity information

NSIRA’s 2020 Review of information sharing across aspects of CSE’s mandate (review no.20-07) examined CSE’s legal authority for internal information sharing within CSE between the foreign intelligence and the CSIA aspects of its mandate, with a particular focus on IRTC. NSIRA found that CSE’s policy framework for such sharing was compliant with the CSE Act; per CSE policy, an assessment of IRTC’s relevance, essentiality, or necessity to each aspect is required for sharing information across the aspects.

As described in the Chief’s applications to the Minister, information acquired under the authorization for cybersecurity activities on federal infrastructure “may also be used by CSE for other purposes authorized under the CSE Act. For instance, the information may be used to enable any other authorized activities under foreign intelligence or active and defensive cyber operations authorizations.” CSE internal policy for cybersecurity further elaborates that:

Subject to conditions imposed by clients or disclosing entities, information assessed as relevant, necessary or essential and retained under the cybersecurity aspect of CSE’s mandate may be used by CSE personnel operating under another aspect of CSE’s mandate, with the exception of the Assistance mandate. The use of this information by another aspect must still align with the cybersecurity aspect (i.e., it is being used for the purpose of helping to protect electronic information or infrastructures of federal institutions or SOIs). This is considered a consistent use of the information by CSE.

According to section 16 of the CSE Act, the foreign intelligence aspect of CSE’s mandate is to “acquire, covertly or otherwise, information from or through the [Gil], including by engaging or interacting with foreign entities located outside Canada or by using any other method of acquiring information, and to use, analyse and disseminate the information for the purpose of providing foreign intelligence, in accordance with the Government of Canada’s intelligence priorities.” These intelligence priorities include some subjects which are directly relevant to the CSIA aspect of CSE’s mandate for example [**redacted**] and [**redacted**].

One example of CSE foreign intelligence use of assessed CSIA information is [**redacted**] CSE could also use assessed CSIA information for defensive or active cyber operations, so long as those operations are linked to a cybersecurity purpose—such as a cyber operation targeting a cybercriminal actor that may pose a threat to Canadian systems. According to CSE, SIGINT analysts can also access unassessed CSIA information, including information collected under cybersecurity authorizations (per ss. 27(1) or (2)). For example, [**redacted**] However, CSE told NSIRA that when SIGINT personnel access or conduct queries of raw CSIA information, they are doing so under the CSIA aspect of CSE’s mandate.

Similarly to CSE’s cybersecurity authorizations, all of CSE’s authorizations for foreign intelligence (Fl) activities (ss. 26(1) of the CSE Act) mention cybersecurity, as well as links between foreign intelligence information and CSIA activities. All such authorizations state that information acquired under them that is identified as being IRTC “will be used, analysed, or retained only if the information is essential to international affairs, defence or security, including cybersecurity.’’ CSE’s internal policy clarifies that:

The central consideration when disseminating foreign intelligence information for use under the cybersecurity aspect of CSE’s mandate is the concept of consistent use—information acquired by CSE under the foreign intelligence aspect of CSE’s mandate must be used for Fl purposes, and may then be shared to recipients acting under cybersecurity authorities if they are eligible to receive and use that information to fulfill their mandated activities.
In order to release Fl under the cybersecurity aspect of CSE’s mandate … The information must be assessed to be of Fl value in support of GC intelligence priorities; IRtC may only be shared with cybersecurity personnel if they meet the essentiality test for Fl, as well being assessed as necessary for cybersecurity activities …

For example, CSE SIGINT analysts can [**redacted**] meaning analysts can act on this information to protect systems cyber threats. Thus, cyber security information acquired under the foreign intelligence aspect can be shared with and used by CSE for the purposes of the CSIA aspect.

ANNEX C: Findings & Recommendations

Findings

Finding no. 5: NSIRA found that SSC was not fully aware of its responsibilities as a system owner, as described in CSE’s applications to the Minister.

Finding no. 6: NSIRA found that, despite the existence of a Memorandum of Understanding between CSE and SSC, there was a lack of clarity between the organizations on the implementation of agreed upon commitments about NBS activities on networks operated by SSC.

Finding no. 7: NSIRA found that CSE did not explain to the Minister why consent to CSE’s cybersecurity activities could not reasonably be obtained from users of Government of Canada systems.

Recommendations

Recommendation no. 1: NSIRA recommends that CSE clearly explain, in its applications to the Minister, that:

Network-based solutions acquire information relating to a Canadian or a person in Canada (IRTC), including information that interferes with the reasonable expectation of privacy (REP)of Canadians or persons in Canada; and,
CSE subsequently uses, analyses, and retains this information for use in cybersecurity and information assurance activities.

Recommendation no. 2: NSIRA recommends that CSE renew its Memorandum of Understanding with SSC to ensure CSE and SSC meet their respective commitments, including any that CSE makes to the Minister regarding SSC’s role in informing system owners about the NBS program.

Recommendation no. 3: NSIRA recommends that CSE update Memoranda of Understanding with all of its cybersecurity partners, to ensure these partners have consented to CSE cybersecurity activities, and to ensure these arrangements reflect, and conform to, contemporary governance authorities. CSE should continue these updates, as a standard practice, as authorities evolve.

Recommendation no. 4: NSIRA recommends that CSE explain to the Minister how consent to CSE’s cybersecurity activities is obtained from users of Government of Canada systems, or otherwise explain why this consent could not reasonably be obtained.

Recommendation no. 5: NSIRA recommends that CSE reconsider whether limits on the acquisition by CSE of information from the global internet infrastructure (as per subsection 22(4) of the CSE Act) apply to information from third-party data sources. This should include an assessment of whether section 8 of the Charter of Rights and Freedoms may be engaged, as well as cases where third-party data sources may contain information that interferes with the reasonable expectation of privacy of a Canadian or person in Canada.

Recommendation no. 6: NSIRA recommends that, in order to continue these acquisition activities that are necessary for cybersecurity and information assurance (CSIA) purposes, CSE assess its current sources of CSIA information—that are acquired outside of an Authorization—for interference with the reasonable expectation of privacy of a Canadian or person in Canada. This assessment should be repeated as required to ensure such information is not acquired without a valid Ministerial authorization.

Recommendation no. 7: NSIRA recommends that section 27 of the CSE Act be amended to permit the Minister to authorize CSE to acquire information that is necessary for CSE’s cybersecurity and information assurance aspect (but which may contain information that interferes with the reasonable expectation of privacy of a Canadian or person in Canada, or contravene an Act of Parliament), from sources other than federal information infrastructures and systems of importance to the Government of Canada.

Date Modified:: 2025-10-02

Review of Communications Security Establishment (CSE)’s Active and Defensive Cyber Operations: Report

Review of Communications Security Establishment (CSE)’s Active and Defensive Cyber Operations

Report

Table of Contents

HTML Version Coming Soon

Date of Publishing:

May 7, 2025

Download PDF

HTML Version Coming Soon

Our team is working on an HTML version of this content to enhance usability and compatibility across devices. We aim to make it available in the near future. Thank you for your patience!

Date Modified:: 2025-05-07

Review of Communications Security Establishment (CSE)’s Active and Defensive Cyber Operations: Backgrounder

Review of Communications Security Establishment (CSE)’s Active and Defensive Cyber Operations

Backgrounder

This marks NSIRA’s second review of the Communications Security Establishment’s (CSE) Active Cyber Operations (ACOs) and Defensive Cyber Operations (DCOs). While the first review focused on planning, approval, and governance processes, this review assessed the operations themselves—specifically, how the governance and legal frameworks are applied in practice.

NSIRA found that the ACOs and DCOs reviewed were lawful. However, it identified areas where improvements could reduce operational risks.

ACOs and DCOs are recent tools in Canada’s foreign and security policy. ACOs are intended to disrupt or interfere with foreign actors to limit threats to Canada’s international relations, defence, or security. DCOs are designed to protect the electronic information and systems of federal institutions and other designated entities. Both types of operations fall under CSE’s mandate as defined in the Communications Security Establishment Act (the Act), and can only be conducted under a Ministerial Authorization.

Importantly, the Act prohibits ACOs and DCOs from targeting Canadians, individuals in Canada, or from infringing upon the Canadian Charter of Rights and Freedoms.

Specific legal requirements that must be met before the Minister can issue an Authorization for ACOs or DCOs. Additionally, unlike other types of Authorizations under the Act that involve information collection, ACO or DCO Ministerial Authorizations do not require approval by the Intelligence Commissioner. This increases the importance of close ministerial oversight. NSIRA found, however, that CSE’s applications for these Authorizations lacked certain key information needed for the Minister to make a fully informed decision. For example, the applications did not clearly explain how cyber operations could lead to the collection of information under a separate authorization, omitting important context for assessing legal and operational implications.

Although the primary focus of this review was on CSE, NSIRA also assessed the roles of Global Affairs Canada, the Canadian Security Intelligence Service, the Royal Canadian Mounted Police, and the Department of National Defence/Canadian Armed Forces, all of which are involved in varying degrees of coordination with CSE’s ACOs and DCOs. While collaboration between agencies exists, NSIRA found that there remains room for improved consultation and coordination.

NSIRA noted that CSE has made progress in refining its planning and execution of ACOs and DCOs, incorporating lessons from NSIRA’s previous review. The current review included four in-depth case studies, which informed both specific findings and broader recommendations.

Date Modified:: 2025-05-09

Communications Security Establishment’s Network-Based Solutions and Related CS/IA Activities: Backgrounder

Communications Security Establishment’s Network-Based Solutions and Related CS/IA Activities

Backgrounder

The Government of Canada faces threats from a broad spectrum of malicious cyber actors—from cybercriminals to sophisticated foreign states—making cybersecurity a top national security priority. Protecting federal systems against these threats is a responsibility of the Communications Security Establishment (CSE), Canada’s lead agency for cybersecurity.

Within CSE, the Canadian Centre for Cyber Security leads efforts to prevent, detect, and respond to cyber threats targeting government systems and infrastructure. In 2019, the Communications Security Establishment Act granted CSE broader powers to strengthen Canada’s cybersecurity posture, including enhanced authorities related to cybersecurity and information assurance (CSIA).

Because CSE’s work involves collecting and analyzing large volumes of digital information—which may incidentally involve Canadians or individuals located in Canada—robust review is essential to ensure these activities remain lawful, and reasonable; in particular, respectful of privacy rights.

In this context, NSIRA undertook its first dedicated review of CSE’s CSIA activities. The review closely examined one of CSE’s key cybersecurity solutions, assessed its broader cyber defence operations, and evaluated how these efforts are coordinated with Shared Services Canada (SSC), who manages much of the federal government’s IT infrastructure.

To identify and prevent cyber threats, CSE acquires and analyzes vast amounts of information. These activities can be highly intrusive and engage significant privacy interests of Canadians, including those who interact with the Government of Canada. NSIRA’s review placed particular emphasis on how information that could impact Canadian privacy interests is managed.

The review concluded that CSE makes critical contributions to securing the Government of Canada’s networks and incorporates measures designed to protect the privacy of Canadians and other persons in Canada. However, NSIRA identified two important areas for improvement.

First, the review found that CSE’s reporting to the Minister of National Defence—the minister responsible for overseeing CSE—lacked sufficient clarity and detail. This gap could hinder the Minister’s ability to make fully informed decisions about CSE’s cybersecurity activities.

Second, NSIRA observed that, in limited cases, CSE’s collection of information from external sources may have implicated the privacy rights of Canadians.

To address these issues, NSIRA issued seven recommendations aimed at enhancing transparency in CSE’s communications with the Minister and strengthening procedures for assessing and managing data that may affect privacy interests.

These findings underscore the vital importance of rigorous, independent review in national security matters. As cyber threats continue to evolve in scale and sophistication, Canada must ensure that its digital defences remain not only effective but also accountable and consistent with Canadian values. NSIRA’s review plays a crucial role in maintaining this balance—ensuring that security and privacy go hand in hand.

Date Modified:: 2025-06-02

Review of Select Communications Security Establishment (CSE) Activities for 2025: Notification Letter

Review of Select Communications Security Establishment (CSE) Activities for 2025

Notification Letter

Table of Contents

NSIRA’s Notification Letter

Date of Publishing:

April 18, 2025

NSIRA’s Notification Letter

Dear Minister Blair,

I am writing on behalf of the Members of the National Security and Intelligence Review Agency (NSIRA) to inform you that NSIRA has initiated a review of its Annual Review of Select CSE Activities for 2025.

This review is being conducted pursuant to paragraph 8(1)(a) of the National Security and Intelligence Review Agency Act (NSIRA Act). The NSIRA Act grants NSIRA full and timely access to all information held by reviewed departments and agencies, including classified and privileged information, with the exception of cabinet confidences.

The review will include the assessment of information related to CSE’s compliance with the law and ministerial direction, as well as the reasonableness and necessity of CSE’s exercise of its powers.

NSIRA will engage with your officials regarding this review. As the review progresses, NSIRA’s review team will be in regular contact with them with requests for information. Such requests may involve documents, system access, written explanations, briefings, interviews, surveys, and any other information that NSIRA determines to be of relevance to this review. This review may also include independent inspections of some technical systems. NSIRA’s expectations for responsiveness are available online at https://nsira-ossnr.gc.ca.

I thank you in advance for your cooperation and support to the independent review process, which is key to transparency and democratic accountability.

Sincerely,

The Honourable Marie Deschamps, C.C.
Chair, National Security and Intelligence Review Agency

Date Modified:: 2025-04-22

Canadian Security Intelligence Service’s Justification Framework: Cancellation Letter

Canadian Security Intelligence Service’s Justification Framework 2021

Cancellation Letter

Table of Contents

Closure of NSIRA’s Review of CSIS’ Justification Framework (21-14)

Date of Online Publishing:

April 8, 2025

Date of Submission:

March 28, 2024

Closure of NSIRA’s Review of CSIS’ Justification Framework (21-14)

Dear David,

I am writing on behalf of the Members of the National Security and Intelligence Review Agency (NSIRA) to inform you that NSIRA’s review of CSIS’ Justification Framework (21-14) has been closed.

NSIRA will initiate a new standalone review of the Justification Framework that will commence in 2024. CSIS already received the formal notification of the launch of this review.

NSIRA recognizes the resources CSIS committed to the previous review. Information already provided by CSIS under the authority of 21-14 will not be requested again and will be used to inform the upcoming review. Any new information will be requested through existing channels and processes.

Sincerely,

Charles Fugere
A/Executive Director and Senior General Counsel
NSIRA Secretariat

Date Modified:: 2025-05-01

Review of Federal Institutions’ Disclosures of Information under the Security of Canada Information Disclosure Act in 2023

Backgrounder

Backgrounder

Review of Federal Institutions’ Disclosures of Information under the Security of Canada Information Disclosure Act in 2023

Report

List of Acronyms

Glossary of Terms

Executive Summary

1. Introduction

Authority

Scope of the Review

Methodology

Review Statements

2. Background

3. Findings, Analysis, and recommendations

Volume and Nature of Disclosures

Table 1: Number of SCIDA disclosures made in 2023, by disclosing and recipient institution [all disclosures (proactive disclosures)]

Record Keeping Requirements – Section 9

Contribution and Proportionality Tests – Subsection 5(1)

SCIDA’s Exception for Advocacy, Protest, or Dissent

IRCC’s New Approach to Proportionality Assessments

CSIS Request Letters

Reliability and Accuracy Statement – Subsection 5(2)

Information Sharing Agreement – Subsection 4(c)

4. Conclusion

Annex A. Sample of Disclosures

Annex B. Cases Relating to IRCC’s Disclosure of Visa Information

Disclosure 1 (Economic Security Threat)

Disclosure 2 (Foreign Entity)

Disclosure 3 (Bulk Data)

Annex C. Overview of SCIDA Disclosures in Prior Years

Annex D. Findings and Recommendations

Record Keeping Requirements – Section 9

Contribution and Proportionality Tests – Subsection 5(1)

Reliability and Accuracy Statement – Subsection 5(2)

Information Sharing Agreement – Subsection 4(c)

Public Safety and Canadian Security Intelligence Service Accountability Mechanisms

Backgrounder

Backgrounder

Public Safety and Canadian Security Intelligence Service Accountability Mechanisms

Report

Executive Summary

List of Acronyms

Introduction

Authority

Scope of the Review

Methodology

Review Statements

Background

The Referral – Did the Minister have the necessary Information?

The Source, the Operation, and the Halt [**redacted**]

Findings, Analysis, and Recommendations

Accountability and Consequences for Halting the [**redacted**] Operation

Responsibility for Briefing the Minister [**redacted**]

Public Safety’s Role in Relation to CSIS

Ministerial Direction to CSIS

Purpose and History

CSIS’s Risk Assessment Process

Purpose and History

Legal Pillar

Foreign Policy Pillar

Reputational Pillar

Conclusion

Annex A. [**redacted**] – A Case Study

Background

Annex B. Role of Minister

Development of the CSIS Act

CSIS Act

Later Parliamentary Scrutiny

ANNEX C. Findings and Recommendations

Accountability and Consequences for Halting [**redacted**] Operation

Responsibility for Briefing the Minister [**redacted**]

Public Safety’s Role in Relation to CSIS

Ministerial Direction to CSIS

CSIS’s Risk Assessment Process

Legal Pillar

Foreign Policy Pillar

Reputational Pillar

Communications Security Establishment’s Network-Based Solutions and Related CS/IA Activities

Report

The Source, the Operation, and the Halt [redacted]

Accountability and Consequences for Halting the [redacted] Operation

Responsibility for Briefing the Minister [redacted]

Annex A. [redacted] – A Case Study

Accountability and Consequences for Halting [redacted] Operation

Responsibility for Briefing the Minister [redacted]