Language selection

Government of Canada / Gouvernement du Canada

Search


Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023

Completed Reviews

Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023


Date of Publishing:

Letter to the Prime Minister

April 26, 2024

The Right Honourable Justin Trudeau, P.C., M.P.
Prime Minister of Canada
80 Wellington Street
Ottawa, ON K1A 0A2

Dear Prime Minister,

On behalf of the National Security and Intelligence Review Agency (NSIRA), it is my pleasure to present you with our special report on the Review of the dissemination of intelligence on People’s Republic of China political foreign interference, 2018-2023.

This review was conducted under the authority of paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act (NSIRA Act).

The review assessed the flow of information, within government, regarding political foreign interference activities carried out by the People’s Republic of China between 2018 and 2023, a period covering the last two federal general elections. Consistent with its mandate and the terms of reference, NSIRA reviewed, among other things: the dissemination practices of the Canadian Security Intelligence Service; the operation of key entities established by the government to protect the integrity of Canada’s elections; and the role of senior public servants, including the National Security and Intelligence Advisor to the Prime Minister, in the dissemination of intelligence. You received a classified version of this report on March 5, 2024.

From the outset of its review, while working independently from the National Security and Intelligence Committee of Parliamentarians (NSICOP), NSIRA helped ensure there was no unnecessary duplication of work between the two review bodies. On March 5, 2024, NSIRA notified NSICOP, as well as the Public Inquiry into Foreign Interference in Federal Electoral Processes and Democratic Institutions, that NSIRA’s classified report had been finalized and provided to you.

At that time, NSIRA further informed you that it was of the opinion that it was in the public interest to report on this matter and would therefore, pursuant to section 40 of the NSIRA Act, be submitting to you a special report to be tabled in Parliament. Over a period of six weeks, in accordance with paragraph 52(1)(b) of the NSIRA Act, NSIRA undertook the required consultations with the deputy heads of concerned agencies and departments to ensure that this special report does not contain information the disclosure of which would be injurious to national security, national defence, or international relations or information that is subject to solicitor-client privilege, the professional secrecy of advocates and notaries, or litigation privilege.

Recognizing the importance of this topic to Canadians, NSIRA made every effort to draft the report in a manner that would be largely releasable. NSIRA sought specific explanations for the redactions that were made and is satisfied that the presented version of the report is the most thorough version that can be released. The findings and recommendations in NSIRA’s classified report did not contain any injurious or privileged information. As such, the findings and recommendations of the special report are identical to those contained in the classified report. 

In line with obligations under the NSIRA Act, this report must be tabled in each House of Parliament within the first 15 days on which that House is sitting. NSIRA will not comment on the contents of its report until such time as this special report is tabled in Parliament, owing to parliamentary privilege.

This report contains 8 recommendations. We ask that the Government indicate to NSIRA whether it agrees with these recommendations and, if so, to explain how they will be implemented. The thorough and timely consideration of NSIRA’s recommendations is essential to ensuring that NSIRA’s efforts with regard to the accountability of government institutions yield results. If and when available, NSIRA may publish the Government’s responses to its recommendations alongside the version of this report on NSIRA’s website and may include them in an Annual Report.

Yours sincerely,

The Honourable Marie Deschamps, C.C.

Chair // National Security and Intelligence Review Agency

Revisions

Pursuant to section 40 of the National Security and Intelligence Review Agency Act (NSIRA Act), NSIRA may submit a special report to the appropriate Minister on any matter related to NSIRA’s mandate. The Minister must then table the special report in Parliament within 15 sitting days.

Prior to the submission of such a report, subsection 52(1)(b) of the NSIRA Act requires NSIRA to consult with the deputy heads concerned to ensure that the special report does not contain information the disclosure of which would be injurious to national security, national defence or international relations or is information that is protected by solicitor-client privilege, the professional secrecy of advocates and notaries or litigation privilege.

This document is NSIRA’s section 40 special report. It is a revised version of the classified report provided to the Prime Minister on March 5, 2024. Revisions were made to remove injurious information. Where information could simply be removed without affecting the readability of the document, NSIRA noted the removal with three asterisks (***). Where more context was required, NSIRA revised the document to summarize the information that was removed. Those sections are marked with three asterisks at the beginning and the end of the summary, and the summary is enclosed by square brackets (see example below).

EXAMPLE: [**Revised sections are marked with three asterisks at the beginning and the end of the sentence, and the summary is enclosed by square brackets.**]

List of Acronyms

Abbreviation Expansion
CEIPP Critical Election Incident Public Protocol
CTSN Canadian Top Secret Network
CSE Communications Security Establishment
CSIS Canadian Security Intelligence Service
DND Department of National Defence
DM Deputy Minister
FI Foreign Interference
GAC Global Affairs Canada
HUMINT Human Intelligence
IAS Intelligence Assessment Secretariat
ISR Independent Special Rapporteur
MP Member of Parliament
NHQ National Headquarters
NSIA National Security and Intelligence Advisor
NSICOP National Security and Intelligence Committee of Parliamentarians
NSIRA National Security and Intelligence Review Agency
PCO Privy Council Office
PRC People’s Republic of China
PMO Prime Minister’s Office
PSB Protective Security Briefing
PS Public Safety Canada
RCMP Royal Canadian Mounted Police
RRM Rapid Response Mechanism
SIGINT Signals Intelligence
SITE TF Security and Intelligence Threats to Elections Task Force
TRM Threat Reduction Measure
UFWD United Front Work Department
Abréviation Développement
AC Administration centrale
AMC Affaires mondiales Canada
BCP Bureau du Conseil privé
CPM Cabinet du premier ministre
CPSNR Comité des parlementaires sur la sécurité nationale et le renseignement
CSNR Conseiller à la sécurité nationale et au renseignement
CST Centre de la sécurité des télécommunications
DER Direction de l’évaluation du renseignement
DTFU Département du travail du Front uni
GRC Gendarmerie royale du Canada
GT MSRE Groupe de travail sur les menaces en matière de sécurité et de renseignements visant les élections
HUMINT Renseignement humain (Human Intelligence)
IE Ingérence étrangère
MDN Ministère de la Défense nationale
MRM Mesure de réduction de la menace
MRR Mécanisme de réponse rapide
OSSNR Office de surveillance des activités en matière de sécurité nationale et de renseignement
PPIEM Protocole public en cas d’incident électoral majeur
RCTS Réseau canadien Très secret
RPC République populaire de Chine
RSI Rapporteur spécial indépendant
SCRS Service canadien du renseignement de sécurité
SIGINT Renseignement électromagnétique (Signals Intelligence)
SISP Séance d’information sur la sécurité préventive
SM Sous ministre
SP Sécurité publique Canada

Executive Summary

The security and intelligence community is of the consensus view that political foreign interference is a significant threat to Canada, and that the People’s Republic of China (PRC) is a major perpetrator of this threat at all levels of government. Nonetheless, the present review of how intelligence related to PRC political foreign interference was disseminated from 2018 to 2023 (a period covering the last two federal elections) indicates that there were significant disagreements between constituent components of that community, both within and across organizations, as to whether, when, and how to share what they knew.

Underlying these disagreements and misalignments was a basic challenge for the security and intelligence community: how to address the so-called “grey zone” whereby political foreign interference may stand in close proximity to typical political or diplomatic activity. NSIRA saw evidence of this challenge across the activities under review, including in decisions about whether to disseminate information and how to characterize what was shared. The risk of characterizing legitimate political or diplomatic behaviour as a threat led some members of the intelligence community to not identify certain activities as threat activities. 

Intelligence is by its nature provisory. It does not constitute proof that the described activities took place, or took place in the manner suggested by the source(s) of the information. At the same time, the fact that it is not proof does not mean it should be withheld – by this standard, very little (if any) intelligence would ever be shared. What is required – between collection and dissemination – is an evaluation of the intelligence and a decision as to whether it should, or should not, be communicated in some way.

With respect to disseminating intelligence about foreign interference in elections, the Canadian Security Intelligence Service (CSIS) confronted a basic dilemma. On one hand, information about foreign interference in elections was a priority for the government, and CSIS had geared its collection apparatus toward investigating political foreign interference. On the other, CSIS was sensitive to the possibility that the collection and dissemination of intelligence about elections could itself be construed as a form of election interference. A basic tension held: any action – including the dissemination of intelligence – taken by CSIS prior to or during an election must not, and must not be seen to, influence that election. 

This dynamic was known within CSIS, but is not formally addressed in policy or guidelines. It was not always clear, particularly to those collecting intelligence, what the general rationale and/or policy guiding the dissemination of intelligence on political foreign interference was, let alone how that rationale/policy applied to specific decisions. Overall, the perception arose within CSIS that rules and decisions were being made, and frequently changed, absent a coherent strategy or guiding principles.

NSIRA recommends that CSIS develop a comprehensive policy and strategy specifically pertaining to all aspects of how CSIS engages – investigates, reports about, and takes action against – threats of political foreign interference. This would bring coherence across the organization. It would also signal to Government of Canada stakeholders that CSIS has carefully considered all aspects of political foreign interference, including its unique sensitivities, and is reporting and advising on those threats using rigorous standards and thresholds. 

CSIS is a member of the Security and Intelligence Threats to Elections (SITE) Task Force, along with the Communications Security Establishment (CSE), the Royal Canadian Mounted Police (RCMP), and Global Affairs Canada (GAC). One of the Task Force’s primary functions is to provide coordinated intelligence reporting to a panel of senior public servants, the Critical Election Incident Public Protocol (CEIPP) Panel, during writ periods. These two bodies were established to receive, analyze, and respond to intelligence coming from the intelligence community with respect to foreign interference in federal elections.

The orientations of the SITE Task Force and CEIPP Panel were geared toward addressing broad, systematic, and largely online interference (such as that witnessed in the 2016 US presidential election). As such, they could not adequately address so-called traditional, human-based, riding-by-riding interference. NSIRA recommends several adjustments to the SITE Task Force and CEIPP Panel, meant to ensure that the full range of threats associated with foreign interference is adequately addressed by these two entities moving forward.

Outside the election context, the intelligence community collects intelligence on PRC political foreign interference on an ongoing basis. This intelligence is shared both horizontally within the community and vertically to senior decision makers, including elected officials.

During the review period, CSIS lacked the ability to definitively track who had received and read its intelligence. This was partly a consequence of the internal tracking systems of the various recipient departments, which may not have comprehensively captured this data. In the end, however, it is incumbent on CSIS, as the originator of sensitive information, to control and document access.

The consequences of not knowing who has received what manifested in the controversy regarding intelligence related to the PRC targeting of a sitting Member of Parliament.

The media and public conversation regarding this intelligence focused on two CSIS products, one from May 2021 and the other from July 2021. In fact, neither product was the mechanism through which the Minister and Deputy Minister of Public Safety were initially meant to be informed of the PRC’s threat activities against the Member of Parliament and his family. Rather, [**prior to May 2021**] there [**was CSIS intelligence**] related to the PRC’s targeting of the Member of Parliament. CSIS sent [**this intelligence**] to named-recipient lists which included the Deputy Minister and Minister of Public Safety.

Public Safety confirmed that at least one [**redacted**] was provided to the Minister [**prior to May**] 2021, likely as part of a weekly reading package. However, the department was unable to account for [**redacted**]. This is an unacceptable state of affairs. NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received and, as appropriate, read intelligence products. 

At the same time, tracking who has received what is not a panacea. There must be interest on the part of consumers for the intelligence they receive, and an understanding as to how the intelligence can support the fulfillment of their responsibilities.

In 2021, PCO and CSIS analysts produced reports meant to serve as synthesizing overviews of PRC foreign interference activities, but which the National Security and Intelligence Advisor to the Prime Minister (NSIA) saw as recounting standard diplomatic activity. This disagreement played a role in those intelligence products not reaching the political executive, including the Prime Minister.

The gap between CSIS’s point of view and that of the NSIA is significant, because the question is so fundamental. CSIS collected, analyzed, and reported intelligence about activities that it considered to be significant threats to national security; one of the primary consumers of that reporting (and the de facto conduit of intelligence to the Prime Minister) disagreed with that assessment. Commitments to address political foreign interference are straightforward in theory, but will inevitably suffer in practice if rudimentary disagreements as to the nature of the threat persist in the community.

NSIRA recommends that regular consumers of intelligence work to enhance intelligence literacy within their departments and that, further, the security and intelligence community develop a common, working understanding of what constitutes political foreign interference. While the NSIA plays a coordinating role within the security and intelligence community, the bounds of this role are not formally delineated. As such, the extent of their influence in decisions regarding the distribution of CSIS intelligence products is unclear. NSIRA therefore recommends that the role of the NSIA, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Introduction

Authority

This review was conducted under the authority of paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act (NSIRA Act).

Scope of the Review

The scope of the review included all intelligence on People’s Republic of China (PRC) foreign interference in federal democratic institutions and processes from 2018 to 2023. The specific focus was on the flow of this intelligence within government. That is, from the collectors of intelligence to consumers of intelligence (“clients”), including senior public servants and elected officials.

The review included the following departments and agencies:

  • The Canadian Security Intelligence Service (CSIS)
  • The Communications Security Establishment (CSE)
  • The Royal Canadian Mounted Police (RCMP)
  • Global Affairs Canada (GAC)
  • Public Safety Canada (Public Safety)
  • The Privy Council Office (PCO)

These are the core members of the security and intelligence community with mandates relevant to foreign interference in Canadian democratic institutions and processes. The review also received information from Elections Canada regarding its relationship with, and the information it received from, the departments and agencies noted above.

Methodology

NSIRA gathered information through a variety of means. This included:

  • Document Review (approximately 17,000 documents);
  • Nine (9) Briefings;
  • Fourteen (14) Interviews;
  • Twenty-one (21) Requests for Information;
    • These included requests for documents as well as requests for written responses to questions.
  • Direct Access to CSIS’s operational database and corporate repository.
  • Direct access to CSE’s foreign intelligence reporting database.

The NSIRA Act grants NSIRA rights of timely access to any information in the possession or under the control of a reviewed entity (reviewee), with the exception of Cabinet confidences, and to receive from them any documents and explanations NSIRA deems necessary.

Initially, NSIRA did not request the release of Cabinet confidences, as the scope of the review did not include policy responses to foreign interference from government, focussing instead on the flow of information within government. However, in his initial public report, the Independent Special Rapporteur on Foreign Interference (ISR), the Right Honourable David Johnston, recommended that NSIRA be given access to any Cabinet confidences that were provided to him for his review. In light of this recommendation, on June 7, 2023, NSIRA wrote to the Prime Minister to request that all Cabinet confidences related to its review be released to the Review Agency, and not just those reviewed by the ISR. 

On June 13, 2023, an Order in Council authorized the release, to NSIRA, of the Cabinet confidences reviewed by the ISR. The scope and focus of NSIRA’s review differs from the ISR’s May 23, 2023 report. The ISR’s report focused specifically on intelligence related to foreign interference in the 43rd and 44th general federal elections and reported on in the media. To safeguard the integrity of its reviews and maintain its independence, NSIRA could not consider a subset of Cabinet confidences (those provided to the ISR) without reviewing all other Cabinet confidences relevant to NSIRA’s particular scope and focus. NSIRA’s broader request to the Prime Minister went unanswered. As a result, NSIRA declined to consider the subset of Cabinet confidences that were provided. Given the scope of the review, NSIRA is nonetheless confident that it received all information necessary to fully support its analysis, findings and recommendations. Pursuant to its obligations under s. 13 of the NSIRA Act, NSIRA cooperated with the National Security and Intelligence Committee of Parliamentarians (NSICOP) to avoid any unnecessary duplication of work in relation to each organization’s review of the topic of foreign interference.

Review Statements

CSIS, CSE, the RCMP, GAC, and Public Safety met NSIRA’s expectations for responsiveness during this review.  PCO only partially met NSIRA’s expectations, due to delays in responding to requests for information.

NSIRA was able to verify information for this review in a manner that met expectations.

Background

Beginning in the fall of 2022, a series of reporting by The Globe and Mail and Global News cited classified CSIS documents on PRC foreign interference into Canadian democratic institutions and processes, including the 43rd and 44th federal elections. This reporting raised concerns regarding the government’s response to the threat of foreign interference and, consequently, the integrity of Canada’s democratic institutions and processes.

On March 9, 2023, NSIRA announced that it would initiate the present review of the production and dissemination of intelligence on foreign interference with respect to the 43rd and 44th federal elections. The review’s focus was on the flow of this information within government, in order to address the fundamental question: did the security and intelligence community adequately report information to those responsible for protecting Canada’s democratic processes and institutions from threats of foreign interference? The granularity of this question – which includes comparing collected raw information to the intelligence ultimately disseminated in finished products – lent itself to NSIRA’s unique mandate and access, including direct access to CSIS’s systems and the ability to speak to intelligence officers in the field. Broader policy considerations (for example what policymakers did or did not do with the information they received) were considered out of scope, and should be addressed by other organizations reviewing activities in this area, including NSICOP and the Commission of Inquiry under the direction of the Honourable Marie-Josée Hogue. NSIRA’s question is foundational in that an effective response requires adequate information.

Political Foreign Interference

Foreign interference includes covert, clandestine or deceptive activities undertaken by foreign actors to advance their strategic, geopolitical, economic, and security interests. This can occur in any sphere of society, including the private sector, academia, the media, and the political system. The latter, political foreign interference, is a subset of foreign interference more broadly.

A prominent example of political foreign interference is the spreading and amplifying of disinformation on social media platforms, such as was perpetrated by Russia during the 2016 US presidential election. Also prevalent are “traditional” (human-based) forms of interference which consist of, among other things: cultivating relationships with political officials for the purpose of interference activities; the recruitment and coercion of individuals involved in politics (including political staff); illicit, illegal, or clandestine financial donations to politicians or political parties; and targeting diaspora communities through threats and intimidation.

According to Canada’s security and intelligence community, the largest perpetrator of foreign interference (political or otherwise) in Canada is the PRC. The PRC engages in widespread and systematic interference operations at all levels of government. These activities are generally the purview of the PRC’s United Front Work Department (UFWD), which is dedicated to shaping and influencing perceptions of, and policy toward, the PRC on a global scale, through a variety of overt and covert means. While the UFWD has been in existence for decades, it is widely recognized that its activities have accelerated following the accession of Xi Jinping to permanent leadership of the PRC, coinciding with increasing tensions between the PRC and Western nations, including Canada.

CSIS has reported about foreign interference since its inception in 1984. The CSIS Act defines “threats to the security of Canada” in section 2, including what it calls “foreign influenced activities” which are “activities that are detrimental to the interests of Canada and are clandestine or deceptive or involve a threat to any person.”

CSIS’s reporting on PRC foreign interference has been subject to public controversy in the past. Most notably, in 2010, then-CSIS Director Richard Fadden made public statements regarding PRC political foreign interference in Canada, indicating that CSIS was investigating multiple politicians whom it believed were “under the influence of a foreign government.” These comments generated significant public criticism, including from the House Committee on Public Safety and National Security, which concluded that “the allegations made by the Director of CSIS tarnished the reputation of politicians and of the Chinese-Canadian community.”  

Eventually, in [**redacted**], CSIS created dedicated desks to investigate PRC foreign interference; [**One sentence edited and one sentence deleted to remove injurious information. The sentences described the organization of CSIS investigations**]. CSIS noted to NSIRA that the volume of foreign interference activity was significant, [**redacted**].

In the following years, investigations have continued to evolve, even as the sensitivity of investigating and reporting about political foreign interference (as demonstrated by the Fadden controversy) remains acute. This tension – between pushing forward on investigations related to foreign interference and tempering such efforts to account for the sensitivities involved – permeated all of the activities examined below. Intelligence is by its nature provisory. It does not constitute proof that the described activities took place, or took place in the manner suggested by the source(s) of the information. That intelligence was “collected” does not imply, necessarily, that it ought to have been disseminated to government clients. At the same time, the fact that it is not proof does not mean it should be withheld – by this standard, very little (if any) intelligence would ever be shared. What is required – between collection and dissemination – is an evaluation of the intelligence and a decision as to whether it should, or should not, be communicated in some way. This process, and these decisions, are fundamental to the work of the security and intelligence community. They are at the heart of the present review.

Findings, Analysis, and Recommendations

This section presents the review’s findings, supporting analysis, and resulting recommendations. The section is organized into three parts, as follows:

  • Part 1 reviews CSIS’s dissemination of intelligence on PRC foreign interference in the 43rd and 44th federal elections. Assessing this flow was the principal aim of the review. NSIRA selected three cases for in-depth review. The details of these cases, along with other information reviewed by NSIRA, inform general findings related to the dissemination of intelligence on PRC political foreign interference, culminating in a broad recommendation to CSIS regarding its governance in this area. 
  • Part 2 examines the role of the Security and Intelligence Threats to Elections (SITE) Task Force and Critical Election Incident Public Protocol (CEIPP) Panel. These bodies were established to receive, analyze, and respond to intelligence provided by the intelligence community. The analysis highlights deficiencies and provides recommendations to better position these bodies to address the threat of political foreign interference.
  • Part 3 steps away from the election-specific context, to assess the broader flow of intelligence on PRC political foreign interference across the security and intelligence community between 2018 and 2023, including to senior public servants and elected officials. Particular attention is given to CSIS’s methods of dissemination, and the role of the National Security and Intelligence Advisor (NSIA) to the Prime Minister. This analysis includes an overview of the dissemination of intelligence regarding the PRC’s targeting of a Member of Parliament, and an assessment of the dissemination of two in-depth analytical intelligence products on PRC political foreign interference.

Taken collectively, these components offer insight into the overall challenges associated with how intelligence about PRC political foreign interference moved within the Government of Canada during the review period.

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

NSIRA reviewed the intelligence produced by CSIS, CSE, GAC, PCO, and the RCMP related to foreign interference in the 43rd and 44th federal elections. In three cases – one from 2019, two from 2021 – NSIRA examined how CSIS disseminated intelligence to relevant entities in the government of Canada, including the SITE Task Force and CEIPP Panel.

Case Study 1 (2019 election)

Case Study 1 involved collected intelligence on PRC foreign interference activities in support of a federal election candidate.

Intelligence associated with this case was widely disseminated, including to the SITE Task Force, the candidate’s party, Elections Canada, the Office of the Commissioner of Canada Elections, senior public servants (including the CEIPP Panel), the Minister of Public Safety, and the Prime Minister. However, in certain instances the dissemination of intelligence lacked timeliness and clarity.

For example, CSIS disseminated and then recalled a key analytical intelligence product on the case prior to the election. On October 1, 2019, CSIS released a six-page National Security Brief on PRC foreign interference activities associated with the case. The brief was disseminated to a list of named recipients, including senior public servants and representatives of the SITE Task Force. Ten days later, on October 10, CSIS recalled the product, and requested that all recipients destroy the copies that had been provided. This decision was taken by the CSIS Director, following a conversation with the NSIA. When asked by NSIRA to explain the rationale behind recalling the product, CSIS indicated that neither the Director nor the Director’s office could remember the specifics of the decision, other than that it was by request of the NSIA.

At the same time, the analysis and associated assessment included in the product were provided (though not necessarily with the same detail) in oral briefings. On September 28, CSIS (in its capacity as a member of the SITE Task Force and facilitated by PCO) briefed Secret-cleared members of the candidate’s party on the intelligence indicating PRC foreign interference. Two days later, on September 30, the CSIS Director briefed this intelligence and CSIS’s assessment to the CEIPP Panel.

The Prime Minister was not directly briefed by CSIS on intelligence regarding PRC foreign interference associated with the case until February of 2021, sixteen months following the election. Nonetheless, the Prime Minister may have indirectly been made aware of the relevant CSIS intelligence. PCO noted that a briefing by PCO to the Prime Minister’s Office (PMO) on “issues related to [Case Study 1] likely took place in late September/early October 2019”, but could not provide NSIRA any documentation to this effect. Further, there is evidence to suggest that the Prime Minister was informed of the content of CSIS’s September 28 briefing on September 29.

In December 2019, the PCO Assistant Secretary of Security and Intelligence prepared a memorandum to the NSIA recommending that the NSIA brief the Prime Minister’s Chief of Staff on CSIS’s assessment [**redacted**]. The briefing would also have raised the potential vulnerabilities in the candidate nomination process. PCO indicated that there was no record confirming that the memorandum was delivered to the NSIA (though PCO was “confident that [the NSIA] was made aware of the information it contained”) and no record that the PMO was briefed as per the memorandum’s recommendation. The NSIA and the Clerk of the Privy Council, as members of the CEIPP Panel, received the September 30, 2019, briefing. In January 2020, CSIS briefed them again on the same issue. CSIS then briefed the Minister of Public Safety on the case in March 2020.

Figure 1: Graphic of Key dates, dissemination of intelligence on Case Study 1

Figure 1. Keydates, dissemination of intelligence on Case Study 1

[**Figure has been edited to remove injurious information**]

Early intelligence reporting on foreign interference activities related to the case did not sufficiently distinguish typical political activity from threat-related foreign interference. While this distinction was largely implicit, absent a clear articulation of why CSIS believed that specific activities constituted foreign interference, consumers – particularly those familiar with the tactics of political campaigns – may not have appreciated the intended import of the intelligence provided.

Case Study 2 (2021 election)

Case Study 2 involved collected intelligence on PRC foreign interference activities [**redacted**].

Intelligence associated with Case Study 2 was disseminated to [**redacted**], the SITE Task Force, the CEIPP Panel and, shortly following the election, the Prime Minister.  

While this dissemination was timely, CSIS deviated from its most common dissemination practices by limiting the number of written Intelligence Reports. It is unclear whether there was an explicit, blanket decision to suspend all Intelligence Report production on Case Study 2 during the election period, or whether the lack of Intelligence Reports was the natural consequence of case-by-case situational factors.

CSIS considered several options for addressing/mitigating foreign interference in this case. [**redacted**]. CSIS deliberated as to whether [**redacted**] should occur before or after the election. Ultimately, the risks of [**redacted**] were considered prohibitive. CSIS noted in particular the risk that if its efforts became public, CSIS might be blamed for interfering in the democratic process [**redacted**].

[**Two sentences deleted to remove injurious information. The sentences describe the dissemination of intelligence related to PRC foreign interference activities**].

Figure 2: Graphic of Key dates, dissemination of intelligence on Case Study 2

Figure 2. Key dates, dissemination of intelligence on Case Study 2

[**Figure has been edited to remove injurious information**]

As in Case Study 1, there were also issues in terms of consumers understanding the intended significance of the intelligence provided. For example, a member of the CEIPP Panel requested clarification as to how the activities were “deceptive and clandestine” (key components of CSIS’s definition of foreign interference) [**redacted**]. [**redacted**]. CSIS further noted that the PRC [**redacted**], ignoring the general notice from GAC to all foreign diplomatic missions in Canada that direct or indirect [**involvement**] in the election was inappropriate.

The intelligence CSIS collected was provided to relevant entities – in particular the CEIPP Panel [**redacted**] – in advance of the election. Indeed, according to those familiar with the Panel’s work, [**redacted**] was considered a clear “success” in terms of the 2021 election. This perception is generally shared by CSIS, [**redacted**] informing senior public officials [**redacted**].  

Nonetheless, CSIS deviated from its most common dissemination process, at least partly as a consequence of the subject matter (political foreign interference).  Further, that CSIS could not definitively say whether an explicit decision had been made to eschew written intelligence products is itself indicative of a lack of clarity with respect to how intelligence on political foreign interference ought to be handled, particularly during elections.

Overall, Case Study 2 is most instructive not as an example of the failed or inadequate dissemination of intelligence, but as further illustration of the unique challenges associated with disseminating intelligence on political foreign interference that, when combined with other examples and cases, reveal broader, systemic issues with how CSIS communicates the information it collects about political processes.

Case Study 3 (2021 election)

Case Study 3 involved collected intelligence on PRC foreign interference across several ridings in a specific geographic region, as well as broader campaigns, with a nexus to that region, targeting the election as a whole. There were multiple pieces of intelligence, on different activities, collected at different times, from different sources, subject to different caveats and considerations, disseminated (or not) at different moments, in different formats, to different recipients. 

Decisions regarding whether, when, and how to disseminate this intelligence were the subject of disagreement, uncertainty, and lack of communication within CSIS. This disconnect was largely between intelligence officers collecting intelligence in the region, and those responsible for disseminating that intelligence at National Headquarters (NHQ) (NHQ includes both the [**dedicated unit in NHQ combining operational and analytical capabilities (hereafter referred to as “dedicated unit in NHQ”)**]  and the CSIS executive). Put simply, intelligence officers did not understand why some of the intelligence they collected was either not disseminated at all or disseminated following what they perceived to be atypical delays. NHQ, by contrast, often had reasons for not disseminating (or delaying) intelligence – typically tied to the unique nature of political foreign interference – that were not communicated or, in the absence of standard criteria or rationale, appeared arbitrary.

Intelligence related to PRC foreign interference in a particular riding is a case in point. [**One sentence deleted to remove injurious information. The sentence discussed the date(s) of collection and the threat activities described by the intelligence**]. The desk collecting and analyzing this intelligence believed it was worthy of being placed into an Intelligence Report for dissemination, particularly because it related directly to the election. In [**Fall 2021**], multiple emails were sent from the region to the [**dedicated unit in NHQ**] requesting an explanation as to why the information had not been disseminated. Eventually, the intelligence was placed into an Intelligence Report (***) and disseminated on [**redacted**] 2021. To the desk, this delay (***) significantly reduced the impact of the information.  

Additional intelligence [**redacted**] regarding other examples/instances of PRC foreign interference was never disseminated. In [**redacted**] 2021, a regional analyst drafted an analytical product incorporating this intelligence in order to detail [**redacted**] PRC foreign interference. However, a senior analyst at the [**dedicated unit in NHQ**] found that the draft product insufficiently contextualized [**redacted**] PRC foreign interference. While the regional desk recognized [**redacted**] it nonetheless believed that appropriate caveats (as are often included in CSIS reporting [**redacted**]) could have sufficiently contextualized the information.  

[**Dedicated unit in NHQ**], by contrast, believed that [**redacted**] problematized the intelligence, such that reporting it would require “contextualizing [**redacted**]. The concern was that the [**redacted**] information [**redacted**] if disseminated absent this context and characterization. For the region, this perceived reticence to push out collected information suggested that different standards were being applied to intelligence on political foreign interference.

There were also challenges and disagreements with respect to intelligence pertaining to broader interference campaigns. Following the election, a political party sent a letter to PCO detailing what they believed to be foreign interference against their candidates in thirteen federal ridings. At the core of the party’s concerns was an online disinformation campaign directed against them.

The SITE Task Force, specifically CSIS and GAC’s Rapid Response Mechanism (RRM) team, devoted significant analysis to this campaign. Ultimately, neither CSIS nor the RRM definitively linked the campaign directly to the PRC. The SITE Task Force’s After Action Report for the 2021 election, finalized in December 2021, concluded that [**one sentence edited to remove injurious information. The sentence summarized the SITE Task Force’s conclusion that it could not definitively link online narratives against the political party to a foreign state actor**]

However, prior to the publication of this report, in [**redacted**] 2021, CSIS collected intelligence [**redacted**] the online disinformation campaign against the political party.

There was disagreement within CSIS as to how to characterize [**redacted**] in the online campaign, and whether or not intelligence about [**redacted**] should or should not be disseminated as intelligence indicating PRC foreign interference. [**Two sentences deleted to remove injurious information. The sentences discussed competing perspectives between the region and a dedicated unit in NHQ regarding how to characterize intelligence regarding potential foreign interference activities**]

The crux of these competing perspectives was differing orientations to, and appreciation for, the sensitivities associated with reporting about political foreign interference, which manifested in different attitudes regarding the threshold for intelligence reporting. [**Two sentences deleted to remove injurious information. The sentences described competing interpretations within CSIS with respect to certain intelligence on possible foreign interference activities, and corresponding differences of opinion regarding dissemination of that intelligence**] This would ensure consumers of the intelligence that CSIS was not simply reporting on the normal political activity [**redacted**] routinely involved in the political process, but rather on activities which posed a threat to Canada’s national security.  

A draft Intelligence Report detailing [**redacted**] in foreign interference during the 2021 election was not disseminated. Rather, this intelligence was repurposed into a more general product on [**redacted**] foreign interference activities overall. In July 2022, [**dedicated unit in NHQ**] advised the region that they were delaying publication of the longer intelligence product until they could secure [**redacted**]for the inclusion of [**redacted**] SIGINT as part of the analysis. The region, by contrast, felt that the product as drafted sufficiently established [**redacted**] threat activities, and ought to be disseminated right away. Given that CSIS could itself view the [**redacted**] SIGINT, delaying dissemination to include this information in the product suggests CSIS felt the need to convince consumers of CSIS’s assessment [**redacted**] rather than simply providing that assessment in its capacity as the security intelligence service of Canada. [**Dedicated unit in NHQ**] further noted that the CSIS executive planned to discuss the product with senior officials outside of CSIS (including the NSIA and the Clerk of the Privy Council) prior to finalization.

Figure 3: Graphic of Key dates, dissemination of intelligence *** in 2021 election

Figure 3. Key dates, dissemination of intelligence [**redacted**] in 2021 election

[**Figure has been edited to remove injurious information**]

Discussions about the product continued over the winter and spring of 2023, culminating in a decision to publish the product in July 2023 for CSIS-only distribution. As of November 2023, CSIS’s intelligence regarding the [**redacted**] potential involvement in foreign interference activities against the 2021 election has not been disseminated in a written intelligence product outside of CSIS, [**redacted**] years since it was initially collected.

Evaluating CSIS’s dissemination of intelligence

Finding 1: NSIRA found that CSIS’s dissemination of intelligence on political foreign interference during the 43rd and 44th federal elections was inconsistent. Specifically, in certain instances:

  • The rationale for decisions regarding whether, when, and how to disseminate    intelligence was not clear, directly affecting the flow of information; and
  • The threat posed by political foreign interference activities was not clearly   communicated by CSIS.

Finding 2: NSIRA found that CSIS’s dissemination and use of intelligence on political foreign interference was impacted by the concern that such actions could interfere, or be seen to interfere, in the democratic process.

Finding 3: NSIRA found that CSIS often elected to provide verbal briefings as opposed to written products in disseminating intelligence on political foreign interference during elections.

Finding 4: NSIRA found that there was a disconnect within CSIS between a region and National Headquarters as to whether reporting on political foreign interference was subject to higher thresholds of confidence, corroboration and contextualization for dissemination.

Within CSIS, political foreign interference is considered a subset of foreign interference more generally, while investigations touching on democratic institutions and processes are subsumed within broader procedures governing CSIS’s treatment of Canadian Fundamental Institutions.  However, intelligence on political foreign interference presents several distinct challenges which are not addressed in policy or guidelines.

CSIS confronted a basic dilemma. On one hand, information about foreign interference in elections was a priority for the government, and CSIS’s collection apparatus was geared toward investigating political foreign interference. On the other, CSIS was sensitive to the possibility that the collection and dissemination of intelligence about the election could itself be construed as a form of election interference. A basic tension held: any action – including the dissemination of intelligence – taken by CSIS prior to or during an election must not, and must not be seen to, influence that election. 

This dynamic was known within CSIS, but is not formally stated in policy or guidelines. Even more importantly, the specific criteria or considerations by which CSIS might balance these potentially competing imperatives are opaque. Absent their clear articulation, decisions appeared arbitrary. It was not always clear, particularly to those collecting intelligence, what the general rationale and/or policy guiding the dissemination of intelligence on political foreign interference was, let alone how that rationale/policy applied to specific decisions. Absent this clarity, frustration mounted (as one email opined, “if we’re not going to inform and share what we know, why are we collecting it?”).

Further, there was no clear basis to justify a decision to take action (including to outwardly report information), leading to a natural risk aversion on the part of decision-makers. Inevitably, this created frustration for those presenting decision-makers with options. Finally, because the rationale remained amorphous, there was no possibility of reasoned discussion and debate within CSIS regarding the proper calibration between the competing imperatives (to inform, but not to influence), nor any consistency in how they were balanced.

There were several instances in which intelligence was not placed into short, raw Intelligence Reports but instead held back for inclusion in longer, analytical pieces. The unique dynamics of political foreign interference may suggest that, in general, such analytical products are better vehicles for reporting collected information; as it stood, the decisions appeared ad hoc, to the point of suggesting a reluctance to place information in Intelligence Reports, as is CSIS’s typical dissemination process.

Likewise, the preference for oral briefings as the mode of dissemination during elections represented a deviation from CSIS’s most common dissemination practices. Whether justified or not, this deviation suggested special practices associated with political foreign interference in the absence of policy or procedures articulating what those special practices are or ought to be, while also creating challenges for tracking and documenting the provision of information.

This opacity with respect to process extended to approvals for counter political foreign interference activities. Whereas formal approval authority for a particular activity might reside at a certain level (for example Regional Director General), there was a recognition that the informal approval level for counter political foreign interference-related activities was the senior executive, including the Deputy Director of Operations or Director. Although not dictated by policy, it also became standard practice to “sensitize” or inform officials from PCO before CSIS could undertake certain counter-foreign interference activities.

For example, prior to the 2021 election, CSIS conducted Protective Security Briefings (PSB) in an effort to educate Members of Parliament (MPs) as to the threat of foreign interference. A regional desk planned a set of PSBs for a limited set of local MPs they determined to be at higher risk for being targets of political foreign interference. However, NHQ directed that the PSBs be paused, so that the [**dedicated unit in NHQ**] could devise a national PSB strategy along the same lines, based on lessons learned from a similar campaign prior to the 2019 election.

The national campaign was designed [**one sentence edited and one sentence deleted to remove injurious information. The sentences described CSIS methods and tactics**]. Such interest, if revealed, might be construed as inappropriate CSIS involvement in the democratic process.

Likely as a consequence of this sensitivity, the national campaign was further complicated by an extensive approvals process, which ultimately expanded to include sensitizing officials at PCO and Public Safety prior to conducting the briefings. In the end, the complexity and delay associated with the national campaign meant that it could not occur as planned. Instead, the region proceeded with as many of its initially planned PSBs as it could prior to the start of the writ period. Contact with MPs during the writ period was deemed inappropriate.

General sensitivities associated with counter-political foreign interference activities also influenced a [**one sentence edited and three sentences deleted to remove injurious information. The sentences described the objectives and implementation of a CSIS operational activity**]. This was a “conscious choice…due to political sensitivities” which, CSIS assessed, may have reduced the intended strategic impact of the [**CSIS operational activity**].  

Finally, sensitivities also influenced the dissemination of specific intelligence products. Most prominently, as discussed above, intelligence collected in [**redacted**] 2021 was ultimately published in an intelligence product for CSIS-only distribution in July 2023. After extensive delay, revision, and consultation, a senior CSIS executive decided not to disseminate the product more widely (see Case Study 3). 

At the core of the issues discussed above is a lack of clarity and communication pertaining to CSIS’s investigations of political foreign interference. Overall, the perception arose within CSIS that rules and decisions were being made, and frequently changed, absent a coherent strategy or guiding principles.

Intelligence is not evidence. Nor is it wild speculation, conjecture, or rumour. In theory, the threshold or standard for what intelligence is disseminated is uniform across the spectrum of threat-related activities. In practice, however, the cases examined demonstrate that, at the very least, there was a perception that standards were higher for intelligence related to political foreign interference. Although a senior CSIS executive told NSIRA that intelligence standards for political foreign interference were not different as compared to other threat-related information, they also outlined that there are sensitivities associated with disseminating intelligence about an individual involved in politics. For example, such information could have an impact on the career of that individual, including their ability to participate in democratic processes.

In some instances, regional collectors and analysts believed that CSIS NHQ (both [**dedicated unit in NHQ**] and senior management) placed too great an emphasis on “smoking guns” in terms of connecting activities directly to state actors.

Pushing for additional corroboration is a fundamental part of intelligence work. Standards, by their very definition, are meant to be uniform, and not differ by circumstance. Yet insisting that the push for corroboration or the standards for dissemination are the same for political foreign interference as compared to other reporting is untenable if it does not accurately reflect how decisions are made in practice. The failure to appreciate and account for the distinct nature of political foreign interference leads to confusion and consternation.

Political foreign interference often operates in the “grey-zone” between legitimate, overt political/diplomatic activity and covert, clandestine interference. Many of the consumers of intelligence on political foreign interference are familiar with political (in the case of ministers, members of parliament, and political parties) or diplomatic (for example officials at GAC) activities. This creates challenges for CSIS with respect to intelligence consumers in terms of making clear to consumers why the reporting is important and threat-related.

In short, CSIS is reporting about activities taking place in the milieu of the clients they serve. The practical implication is that any intelligence that is disseminated must sufficiently distinguish between legitimate and illegitimate activity. This can be difficult in practice, especially as the nature of PRC foreign interference in particular consists of the steady accumulation over time of activities and pressure that, in isolation and absent additional context, may appear innocuous, but in sum constitute a campaign to interfere in Canada’s democracy. PRC foreign interference is a growing rumble, not a loud bang.

There are several key shortcomings related to CSIS’s dissemination and use of intelligence on political foreign interference. First and foremost, CSIS has not clearly articulated its risk tolerance for counter political foreign interference activities. A defined risk tolerance allows those approving action to understand the parameters within which CSIS is comfortable operating.

Second, and relatedly, the approvals process for counter politicalforeign interference activities does not always reflect actual practice. For example, there are few clear directions and expectations in existing CSIS policy regarding when and why external entities – such as Public Safety and PCO – will be consulted prior to particular actions or activities, and none that account for the specific dynamics of counter political foreign interference activities noted above. Of note, in May 2023 the Minister of Public Safety issued a Ministerial Direction to CSIS on Threats to the Security of Canada Directed at Parliament and Parliamentarians, which outlines consultation principles in that specific context. However, the MD does not pertain to foreign interference against other democratic institutions.

Third, CSIS does not make explicit its thresholds for production and dissemination specifically related to intelligence on political foreign interference. That is, the level of confidence and corroboration required for collected information to be placed in an intelligence product, and the level of additional contextualization, such that the product can be disseminated to Government of Canada clients. The sensitivities associated with this type of intelligence, and the corresponding requirements for greater confidence and corroboration as compared to other types of security intelligence, should be acknowledged. For example, CSIS may wish to evaluate whether [**redacted**] criteria for Intelligence Report production are well suited for the specific nature of intelligence on political foreign interference.   

What is needed, ultimately, is a comprehensive policy and strategy specifically pertaining to all aspects of how CSIS engages – investigates, reports about, and takes action against – threats of political foreign interference. This would bring coherence across all regions and NHQ, and generally facilitate greater understanding and communication between levels of the organization, from intelligence officers to analysts to senior management. At the same time, it would signal to Government of Canada stakeholders, and in particular senior decision-makers, that CSIS has carefully considered all aspects of political foreign interference, including its unique sensitivities, and is reporting and advising on those threats using rigorous standards and thresholds. 

Canada is not alone in facing PRC political foreign interference. In the last several years, all of Canada’s Five Eyes partners (Australia, New Zealand, the US, and the UK) have publicly acknowledged the threat posed by PRC foreign interference to their respective democracies. There is a significant opportunity to leverage these shared experiences into best practices.

Recommendation 1: NSIRA recommends that CSIS develop, in consultation with relevant government stakeholders, a comprehensive policy governing its engagement with threats related to political foreign interference. This policy should:

  • make explicit CSIS’s thresholds and practices for the communication and dissemination of intelligence regarding political foreign interference. This would include the relevant levels of confidence, corroboration, contextualization and characterization necessary for intelligence to be reported;
  • clearly articulate CSIS’s risk tolerance for taking action against threats of political foreign interference;
  • establish clear approval and notification processes (including external consultations) for all activities related to countering political foreign interference;
  • make clear any special requirements or procedures that would apply during election/writ periods, as necessary, including in particular procedures for the timely dissemination of intelligence about political foreign interference; and,
  • consider best practices from international partners (in particular the Five Eyes) regarding investigating and reporting about political foreign interference.

Part 2: The SITE Task Force and the CEIPP Panel

In the wake of well-documented Russian foreign interference in the 2016 US presidential election, the Government of Canada instituted a suite of measures meant to protect the integrity of federal elections. Three such measures are pertinent to the present review:

  • Critical Election Incident Public Protocol (CEIPP) Panel. Established by Cabinet directive, the CEIPP is in place during the election period and administered by a panel of senior public servants.  The Panel assesses security and intelligence information to determine whether to make a public announcement that “an incident or an accumulation of incidents has occurred that threatens Canada’s ability to have a free and fair election.” The Protocol was not invoked – that is, no public announcements were made – in either the 2019 or 2021 election.
  • The Security and Intelligence Threats to Election (SITE) Task Force. The SITE Task Force is composed of representatives from CSIS, CSE, the RCMP, and GAC. The primary purpose of the Task Force is to provide coordinated intelligence reporting on threats to elections to the CEIPP Panel.
  • G7 Rapid Response Mechanism (RRM). Established at the 2018 G7 meeting in Charlevoix, Canada’s RRM is housed within GAC, and focuses on foreign threats to democratic processes via threat analysis and reporting on online information manipulation activities by foreign state actors. The RRM team serves as GAC’s representative on the SITE Task Force.

These entities played significant roles with respect to the flow of intelligence on PRC foreign interference during the 2019 and 2021 elections. In essence, the SITE Task Force served – or was intended to serve – as a conduit for threat intelligence, while the Panel stood in receipt of that information, with a unique mandate to communicate, or not, with the Canadian public regarding the information it was provided.

Finding 5: NSIRA found that the SITE Task Force and the CEIPP Panel were not adequately designed to address traditional, human-based foreign interference. Specifically:

  • The SITE Task Force focuses on threat activities during the election period, but traditional foreign interference also occurs between elections.
  • Global Affairs Canada’s representation on the SITE Task Force focused on online foreign interference activities.
  • The CEIPP Panel’s high threshold for a public announcement is unlikely to be   triggered by traditional foreign interference, which typically targets specific ridings.

The structure and orientation of both the Task Force and the Panel were shaped by the imperative to protect elections against widespread and coordinated foreign interference occurring up to and including Election Day. That is, to protect Canadian elections from the type of foreign interference (largely online disinformation) witnessed in the US and elsewhere.

At the same time, the security and intelligence community recognized that human-based, so-called “traditional” foreign interference had been, and continued to be, the most significant threat to Canadian democratic processes and institutions. For example, the SITE Task Force’s 2021 threat overview noted that foreign interference actors predominately used human-based tactics “partly as a result of the way that Canada conducts its elections…but also due to the efficacy of HUMINT-based influence operations as compared to cyber activities given the structure of the Canadian electoral system.” Overall, the predominance of traditional foreign interference was known prior to 2019, and subsequent experience reinforced this perception.

Despite this recognition, the parameters of the SITE Task Force and the CEIPP Panel are not aligned with the nature of the threat stemming from traditional foreign interference.

In a post-election Panel debrief, a Panel member noted that a major, widespread and successful interference campaign did not occur and that the election had been “clean” despite “some stuff” occurring. The foreign interference in a specific riding [**redacted**], according to this panelist, was “not material to the election” and therefore not of direct concern to the Panel’s remit. At the same meeting, the CSIS Director asserted that the “strongest case” of PRC foreign interference during the election were the events cited in this riding. The Director also lamented that “the machine” (the SITE Task Force and the CEIPP Panel) was not set up to address foreign interference outside of the election period.

Unlike broad patterns or campaigns (such as widespread online disinformation), intelligence on traditional foreign interference in elections is typically granular and specific, pertaining to the activities of individuals in particular ridings. Assessing the impact of those activities at the riding-by-riding level requires receiving and analyzing all relevant intelligence on an ongoing basis. This is doubly challenging given the short time frame in which elections occur.

Similarly, a core feature of traditional foreign interference is that it takes place over the long term, and is not confined simply to election periods. While the SITE Task Force is in continual operation, its capacity and operational tempo is reduced outside election periods. Moreover, its focus remains on the election period, and on the outcome/integrity of the vote on Election Day. These features undermine the Task Force’s ability to fully address traditional foreign interference, which is not confined to election periods and threatens democratic institutions more broadly. 

Consider also the inclusion of the RRM team as GAC’s representation on the Task Force. The RRM is specifically geared toward the online space, and monitoring social media for potential foreign interference activities, including the spreading and amplification of disinformation. By contrast, GAC’s capacity to analyze intelligence related to, and devise potential responses against, traditional foreign interference is not sufficiently represented on the Task Force. Traditional foreign interference frequently runs through [**redacted**]. There is a significant role for GAC to play in terms of response (for example issuing démarches or expelling diplomats) and interpretation (for example on the difference between foreign interference and legitimate diplomatic activity) that extends beyond the RRM team’s specific remit.

Finally, the CEIPP Panel’s threshold for a public announcement as to the integrity of the election is geared toward broad, systematic foreign interference such as that constituted by online disinformation campaigns or other cyber activities. This means that, in practice, the public may hear nothing from the Panel, even as significant foreign interference takes place, so long as that interference remains below what is recognized to be an incredibly high threshold.

A lack of public communication – transparency – creates several potential issues and can be interpreted in multiple ways. If information about specific foreign interference attempts emerges following the election, no communication during the election may be interpreted as a lack of action, or lack of willingness to take action, on the part of the government. If no such information emerges, the lack of communication, and associated implication that the integrity of the election was not threatened by foreign interference, may give a false impression as to the level of foreign interference that occurred.

Recommendation 2: NSIRA recommends that the SITE Task Force align its priorities with the threat landscape, including threats which occur outside of the immediate election period.

Recommendation 3: NSIRA recommends that Global Affairs Canada (GAC) and the Privy Council Office ensure that GAC’s representation on the SITE Task Force leverages the department’s capacity to analyze and address traditional, human-based foreign interference, in addition to the online remit of the Rapid Response Mechanism Team.

Recommendation 4: NSIRA recommends that the Privy Council Office empower the CEIPP Panel to develop additional strategies to address the full threat landscape during election periods, including when threats manifest in specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

This final section of the report steps away from the election-specific context to consider the flow of intelligence on PRC foreign interference between 2018 and 2023 more broadly. As noted, political foreign interference is everywhere and all the time. The intelligence community collects intelligence on PRC political foreign interference on an ongoing basis. This intelligence is shared both horizontally within the community and vertically to senior decision makers, including elected officials.

The responsible sharing of intelligence between organizations is an important feature of a healthy security and intelligence community. While sensitivities, particularly of sources and methods, make the classification of material necessary, and the need-to-know principle further conscribes the circle of individuals who may view certain information, the cross-fertilization of intelligence enhances the ability of organizations to inform decision-makers from the perspective of their particular mandates.

Finding 6: NSIRA found that the limited distribution of some CSIS and CSE intelligence to senior officials-only reduced the ability of the Royal Canadian Mounted Police, Global Affairs Canada, and the Privy Council Office to incorporate that intelligence into their analysis.

With respect to intelligence on PRC foreign interference, reporting from the core “collectors” (CSIS and CSE) informed intelligence analysis by the other security and intelligence organizations under review (GAC, the RCMP, and PCO).

However, this cross-fertilization was not without issues. For example, a GAC assessment from late August 2021 discusses CSIS intelligence indicating PRC political interference but omits other, specific CSIS intelligence directly relevant to GAC’s assessment. Given the sensitivity of the intelligence, however, the CSIS Intelligence Report pertinent to, but missing from, GAC’s analysis was sent to “named recipients only”, meaning that although senior officials at GAC had access to it, analysts within GAC’s Intelligence Bureau did not. This dynamic was typical of many Intelligence Reports produced and disseminated on PRC political foreign interference, making it challenging, on occasion, for recipient organizations to incorporate that intelligence into their own analytical assessments. 

In the case of the expulsion of PRC diplomat Zhao Wei in May 2023,  [**redacted**]. (At the same time, disagreements persisted between CSIS and GAC as to what does or does not constitute “legitimate diplomatic activity”.)

A similar dynamic pertained to CSE SIGINT on PRC foreign interference. While many End Product Reports – CSE’s standard intelligence product – were incorporated into GAC, PCO, and RCMP analysis, some of the most pertinent intelligence was classified at a level which significantly limited its distribution, due to the sensitivity of the collection method. This intelligence was available to a limited number of individuals (including senior officials) within government who possessed the requisite indoctrination.

There is a balance to be struck between protecting sensitive information by limiting its distribution and ensuring pertinent information is shared to inform intelligence analysis and potential action across the government. NSIRA did not assess whether specific intelligence products were or were not “over-classified”, other than to note that decisions regarding classification have direct consequences for dissemination.

Finding 7: NSIRA found that CSIS and Public Safety did not have a system for tracking who received and read specific intelligence products, creating unacceptable gaps in accountability.

Intelligence is shared within the Government of Canada in a multitude of ways. CSIS intelligence in particular may be shared directly by secure email, or by uploading products to platforms such as the Canadian Top Secret Network (CTSN) and CSE’s SLINGSHOT repository.  Hard copies of products can be disseminated via CSE’s Client Relations Officer (CRO) program, with embedded officers serving clients in various departments and agencies. Some departments, such as GAC and Public Safety, have their own in-house intelligence dissemination officers. Secure emails with intelligence products in attachment provide instructions to contacts regarding who in the department should receive the product (for example Deputy Ministers and Ministers).

During the review period, CSIS lacked the ability to definitively track who had received and read its intelligence. Partly this was a consequence of the internal tracking systems of the various recipient departments, who may not have comprehensively captured this data. In the end, however, it is incumbent on CSIS, as the originator of sensitive information, to control and document access.

Intelligence on the PRC targeting of a Member of Parliament

The consequences of not knowing who has read what manifested in the controversy regarding intelligence related to the PRC’s targeting of a sitting Member of Parliament.

In May 2023, media reporting revealed that the Government of Canada had intelligence that a Member of Parliament and his family members had been “targeted” for sanction by the PRC.

The media and public conversation centered around two CSIS products. First, a July 2021 CSIS Intelligence Assessment [**sentence edited to remove injurious information. The sentence described the contents of the Intelligence Assessment, which included intelligence related to PRC foreign interference activities**]. And second, a May 2021 “Issues Management Note” sent by CSIS to senior government officials to inform them that CSIS would be briefing two MPs (including the Member of Parliament in question) on PRC threat-activities against them.

The focus on these two products was misplaced. Neither was the mechanism through which the Minister and Deputy Minister of Public Safety were initially meant to be informed of the PRC’s threat activities against the Member of Parliament and his family.

Rather, [**prior to May 2021**] there was [**CSIS intelligence**] related to the PRC’s targeting of the Member of Parliament. [**CSIS intelligence was**] sent to named recipients lists which included the Deputy Minister and Minister of Public Safety. [**CSIS intelligence**] was disseminated by secure email directly to individuals and departmental contacts. The departmental contacts were directed to provide the information to named senior individuals, including the Minister of Public Safety, as these officials would not have had direct access to secure email. Additional named recipients of [**CSIS intelligence**] included the NSIA, the Clerk of the Privy Council, the Deputy Minister of National Defence, the Foreign and Defence Policy Advisor, the Chief of CSE, and other senior officials at GAC, PCO, DND, CSE, and Public Safety.

CSIS disseminated [**redacted**] 2021. [**Sentence deleted to remove injurious information. The sentence summarized CSIS intelligence**] Public Safety indicated to NSIRA that [**CSIS intelligence**] was distributed internally the week of [**redacted**] 2021 and that the “only indication is that it was sent to senior management.”  

Next, on [**redacted**] 2021, CSIS disseminated [**redacted**] containing intelligence that [**Sentence edited to remove injurious information. The sentence summarized CSIS intelligence**] Public Safety indicated to NSIRA that [**CSIS intelligence**] was distributed internally the week of [**redacted**], 2021 and that the “only indication is that it was sent to the Minister.”

Finally, on [**redacted**] 2021, CSIS disseminated [**Sentence edited to remove injurious information. The sentence summarized CSIS intelligence**] The information was required urgently as [**redacted**]. Public Safety indicated to NSIRA that it had no record of receiving this [**CSIS intelligence**].

Figure 4: Graphic of Key dates, dissemination of intelligence on targeting of a federal MP

Figure 4. Key dates, dissemination of intelligence on targeting of a federal MP

[***Figure has been edited to remove injurious information***]

As noted above, Public Safety stated that at least one [**piece of CSIS intelligence**] was provided to the Minister of Public Safety, likely as part of a weekly reading package in [**redacted**] 2021. This would have preceded by several months both the Issues Management Note of May 2021 and the Intelligence Assessment of July 2021. There is no indication that [**redacted**] was provided to the minister, despite the fact that he was a named recipient on the distribution list.

Most problematic is Public Safety’s inability to account for [**redacted**]. In the wake of the public controversy in 2023, CSIS and Public Safety compiled a chronology of relevant events. Public Safety suggested that perhaps “human error” accounted for the gap in its records, and that the file may have accidently been deleted. Further, the CSIS Director and the NSIA requested that the joint CSIS-PS chronology reflect the fact that “the distribution of a document does not indicate that a document was received or read by the recipient.” This notion – of a possible black hole between the dissemination of a critical product and its receipt on the other end – is a demonstrably unacceptable state of affairs.

As this case makes clear, it is incumbent on CSIS to implement a system that comprehensively tracks the dissemination and receipt of its own intelligence, including, in the case of certain prioritized intelligence, who has read specific products. Prioritized intelligence could include highly sensitive and urgent intelligence, for example regarding threats of foreign interference against elections or other key democratic institutions or processes.

Recommendation 5: NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received intelligence products. In the case of highly sensitive and urgent intelligence, this should include documenting who has read intelligence products.

At the same time, tracking who has read what is not a panacea. There must be interest on the part of consumers for the intelligence they receive, and an understanding as to how the intelligence can support the fulfillment of their responsibilities.

Finding 8: NSIRA found that the dissemination of intelligence on political foreign interference from 2018 to 2023 suffered from multiple issues. Specifically:

  • Intelligence consumers did not always understand the significance of the intelligence they received nor how to integrate it into their policy analysis and decision-making;
  • There was disagreement between intelligence units and senior public servants as to whether activities described in specific intelligence products constituted foreign interference or legitimate diplomatic activity.

Finding 9: NSIRA found that there was disagreement between senior public servants and the NSIA as to whether intelligence assessments should be shared with the political executive. Ultimately, the NSIA’s interventions resulted in two products not reaching the political executive, including the Prime Minister.

Finding 10: NSIRA found that the NSIA’s role in decisions regarding the dissemination of CSIS intelligence products is unclear.

In multiple briefings and interviews from across the community, NSIRA heard about the challenge of articulating the “so-what” in intelligence analysis. Part of this challenge stems from so-called “literacy gaps” between the intelligence and policy communities; that is, low policy literacy on the part of intelligence analysts, and low intelligence literacy on the part of policy analysts or policymakers. This gap can create confusion as to what intelligence is for, and what can be done about the threats that intelligence describes.

Consider for example the emphasis on “actionable” intelligence or “recommendations” for action that consumers look to the intelligence community to provide. Not all intelligence will come with these characteristics. Instead, intelligence may be provided for information and awareness purposes only (including to increase the salience of important trends and threats). Intelligence analysts explained that, ultimately, it is the consumers of intelligence who have the mandate to take action (including to shape strategic policy), while the analyst’s job is to provide them with information that best allows them to do so.

The core function of the intelligence process is the provision of intelligence analysis to policymakers. In-depth analysis – the weaving together of disparate data into a coherent narrative, with judgments and assessments as to the implications of the information presented – is the purview of dedicated units within security and intelligence agencies, such as CSIS’s Intelligence Assessment Branch (IAB) and PCO’s Intelligence Assessment Secretariat (IAS). It is the job of analysts to contextualize collected intelligence for senior consumers.

The dissemination of intelligence to the political executive can occur verbally, in both formal and informal briefings, by senior public servants, such as Deputy Ministers and, in the case of the Prime Minister, the NSIA. At the same time, written analytical products can provide the political executive with key analysis and pressing takeaways regarding threats to the security of Canada.

PCO “Special Report”

In the fall of 2021, the acting NSIA received a series of briefings from PCO IAS on PRC foreign interference. In order to understand more about the issue the acting NSIA commissioned a “Special Report” that would combine foreign intelligence (the traditional purview of IAS) with domestic, security intelligence (CSIS’s domain).

In broad terms, the Special Report was intended to provide a “summary assessment of China’s foreign interference (FI) activities, both in Canada and internationally.” The report was based on over [**redacted**] CSIS reports, [**redacted**] reporting, and open source analysis. Key judgements included that the “Canadian intelligence community is of the consensus view that China poses the most significant foreign interference (FI) threat to Canada” that “Canada remains [**redacted**] to China’s FI efforts”, and finally that “China’s FI efforts are sophisticated, persistent and multidimensional. Electoral interference is only a subset of China’s broader FI efforts.”  

In late November 2021, IAS shared a draft of the report with CSIS for comment and feedback. A senior CSIS executive responded positively to the product, suggested a few areas for improvement, and provisionally approved PCO’s proposed dissemination list, contingent on the CSIS Director also reviewing the report. The list included “Senior PMO” as well as deputy ministers (or equivalent) across relevant departments (Justice, GAC, DND, Public Safety, CSIS and CSE). At the same time, PCO IAS requested that its production team provide a copy of the report to the Clerk of the Privy Council, the Deputy Clerk, and PMO (noting that the acting NSIA had already received a copy).

This did not occur. Shortly following the emailed request, a senior employee within IAS contacted the production team in person and told them not to share the product as instructed, as IAS had “determined that a feedback and steerage discussion with the a/NSIA…was required first, before finalizing the report and sharing it more broadly.” In mid-December, the acting NSIA provided additional feedback on the paper, which was incorporated into a second draft. This feedback concerned the tone of the paper, and in particular clarifying whether what the paper described included standard diplomatic activity.

In January 2022, a new NSIA was appointed. IAS briefed the new NSIA on the Special Report, and provided them, along with other senior executives in the NSIA’s branch, a hard copy with a covering note. The covering note was sent by the Assistant Secretary of IAS (the most senior individual within IAS) and addressed to the NSIA. It briefly described the contents of the Special Report and explicitly recommended that the report be approved and “provided to select Deputy Ministers and Cabinet Ministers.”

In February 2022, there were no bilateral meetings between the Assistant Secretary of IAS and the NSIA, and no further discussions on the Special Report. PCO explained to NSIRA that the Freedom Convoy in Ottawa and Russia’s invasion of Ukraine were the government’s top security priorities during this period. In early March 2022, elements of the Special Report were included in talking points prepared for the NSIA ahead of a briefing. NSIRA did not obtain the details as to who the NSIA briefed at this time as they were withheld by PCO as a Cabinet confidence. In April 2022, an electronic version of the Special Report was made available to the NSIA [**redacted**] but was not accessed during that time. PCO had no further records of any discussions regarding the Special Report, until renewed interest following portions of the report appearing in media reporting in early 2023.

Figure 5: Graphic of Key dates, PCO “Special Report”

Figure 5. Key dates, PCO “Special Report”

[**Figure has been edited to remove injurious information**]

Ultimately, the Special Report remained in draft form, and was never approved, finalized, or disseminated. While several senior public servants at CSIS and PCO read draft versions of the product,  it never reached Cabinet Ministers or the PMO.

PCO cited several reasons to NSIRA as to why the Special Report was never disseminated. The relevant portion of their response is provided in full here:

The report was not published for various reasons. First, its original purpose was to inform the then A/NSIA…on foreign interference, which it accomplished. [The] A/NSIA, [the new] NSIA [as of January 2022], as well as other senior PCO officials benefitted broadly from the analysis, which helped inform the development of policy advice and engagement with counterparts. Furthermore, the document was drafted immediately prior [to] the “Freedom Convoy” and the start of the Russia-Ukraine war. The Government, the NSIA and, to some extent, IAS were focused on these pressing priorities. In addition, the domestic analysis portion of the assessment was largely based on already published and disseminated CSIS material. While depicting an alarming situation, it did not refer to any specific issue that would have required a government decision or an immediate tactical response.

As such, given the fact that the document had fulfilled its purpose, other pressing priorities had emerged, and that the NSIA had outstanding questions and comments pertaining to the document, [the NSIA] did not direct [the Assistant Secretary of IAS] to publish the document, nor did [the Assistant Secretary of IAS] choose to publish the product on [their] own authority. This “test-case” analysis – which combined domestic and foreign intelligence – was nonetheless useful and demonstrated the potential of that type of assessment moving forward.

PCO did not specify to NSIRA what the NSIA’s “outstanding questions and comments pertaining to the document” were, and how they may have contributed to the decision not to finalize the report and disseminate it to the political level. Nor did the NSIA indicate the authority of the Assistant Secretary of IAS to disseminate intelligence products contrary to a decision from the NSIA. Moreover, the expressed purpose of the report was to provide a general overview of PRC foreign interference, not to provide information requiring a specific “government decision or…immediate tactical response.” The point, in other words, was precisely to depict “an alarming situation”, for the awareness of decision-makers. Indeed, the rationale outlined by PCO above belie sentiments expressed in internal PCO correspondence, in which analysts and management alike discuss the import of the Special Report, in addition to the support and concurrence for the report’s analysis provided by a senior CSIS executive and a senior CSIS intelligence analyst. There was a feeling within IAS that the report would be impactful, given the full view it provided of PRC foreign interference activities. Elsewhere, a CSIS executive noted that the product was being developed “to provide to decision makers so they understand the enormity of the situation.” This feeling is reflected in the aforementioned recommendation, in January 2022, that the Special Report be shared with members of Cabinet.

CSIS “Targeting Paper”

In early 2021, a CSIS analyst produced a report combining SIGINT [**one sentence edited and one sentence deleted to remove injurious information. The sentences discussed collection methods and technical systems**]. The report provided analysis of PRC foreign interference activities against federal Canadian political actors [**redacted**]. The intent was to provide an overview to policymakers of the PRC’s strategy and tactics related to the “targeting” (for influence/interference) of [**redacted**]. CSIS characterized the report as the “most complete and detailed analysis of PRC foreign interference directed against political actors produced to date.”

A final draft of the report – known as the “Targeting Paper” – was completed in June 2021. According to CSIS, the report was circulated at this time to a small number of senior officials (though NSIRA cannot confirm this as it is not reflected in CSE tracking logs for the product). Nonetheless, the product remained unpublished and was not formally disseminated. 

CSIS provided several reasons as to why the report did not move forward at the time, including logistical challenges associated with the classification of the material (which made distribution difficult), the impact of COVID-19, management turnover, legal issues [**redacted**], and the overall sensitivity of the content (which required consulting on distribution with the senior executive). According to a senior CSIS executive, there was never any intent for the report not to go out, as it was considered to be an important product. 

In October 2022, the author of the report reached out to CSIS management to push for the product’s publication, given the significant interest in foreign interference generated by the media leaks. In November 2022, CSIS began coordinating [**redacted**] the report’s publication. The intent was to publish the report in CSE’s SLINGSHOT repository as a CSIS product. Over the next two months, conversations centred on the distribution list and intended “roll out” of the report. CSIS determined that it would initially go to senior public servants and, shortly thereafter, to the “political level” (e.g. relevant ministers). In early February, a limited distribution list of senior public servants was finalized. The report was then published in SLINGSHOT on February 13, 2023.

Nine days later, on February 22, the report was made inaccessible. During the period in which the product was available, records indicate that it was seen by roughly 40 public servants, including the NSIA, the Clerk of the Privy Council, and the CSIS Director.

The decision to make the report inaccessible was made by the CSIS Director, at the request of the NSIA. When asked about this decision by NSIRA, the Director’s office replied that “to the [Director’s] recollection it was decided [to pause the report] because the information was extremely sensitive and there needed to be further discussions regarding its distribution. The request was not to limit or censor the report but to ensure proper readership.” Specifically, according to the Director, the NSIA’s concern was that the “distribution list was too large given the content.” As of November 2023, no revised distribution list had been approved, and the report remained unavailable.

PCO confirmed that the NSIA’s request to pause the product was predicated on the NSIA’s belief that the initial distribution list was too wide. In addition, however, “the NSIA had posed questions for CSIS response pertaining to what possible actions could/would be taken about the intelligence contained in the report.” CSIS, for its part, made no reference to any such request in their responses to NSIRA regarding the product. Most strikingly, PCO explained that it “was also the NSIA’s view that the activity indicated in the report did not qualify as foreign interference, but was rather part of regular diplomatic practice.” PCO claims that this position was supported by unnamed Deputy Ministers. This is in stark contrast to CSIS’s characterization of the report as the most complete and detailed analysis of PRC foreign interference directed against Canadian political actors.

On February 24, a meeting was held at PCO to discuss the product. Attendees included the CSIS Director, the NSIA, the Chief of CSE, the Clerk of the Privy Council, the DM of Public Safety, the DM of GAC, and the report’s author (a senior CSIS analyst). According to CSIS, the outcome of this meeting was a request from the NSIA to produce a shorter and “sanitized” (i.e., with names [**redacted**] anonymized) version of the report specifically for the Prime Minister.

The CSIS analyst completed a Prime Minister-version of the report on March 9, 2023. As of November 2023, the Prime Minister has not seen, read, or had access to this product. The CSIS Director was unaware of this fact. In terms of dissemination, the CSIS analyst (the report’s author) explained that they required an approved distribution list, which only the Director and NSIA could provide, and that they could not action the report independently. CSIS further explained that “the Director’s office staff were aware…that no action on the PM version would be taken without a new distribution list from the [Director] and NSIA” but that “conflicting priorities during the spring and summer meant that the Director’s Office did not raise the issue with the Director.” Given that “neither the NSIA nor the NSIA’s office followed up with the Director on the status of the request for a PM version of the report” the Director was under the impression “that the PM had seen it.”

Figure 6: Graphic of Key dates, CSIS “Targeting” Paper

Figure 6. Key dates, CSIS “Targeting” Paper

[**Figure has been edited to remove injurious information**]

While CSIS was clear that this version of the report was drafted specifically for the Prime Minister, the Director noted that the ultimate decision as to whether or not to provide it to the Prime Minister rested with PCO. According to PCO, however, “the report in question was not specifically for the Prime Minister’s consumption.” This again is a jarring contrast in perspectives between CSIS and PCO. CSIS is under the impression that the outcome of the February 24 meeting was a directionfrom the NSIA to create a version of the Targeting Paper for the Prime Minister; this is difficult to reconcile with the NSIA’s position that this same product was not specifically intended for the Prime Minister. Moreover, based on CSE tracking records, no other senior officials – including from PCO or PMO – have seen the condensed version of the product either. As far as CSIS is aware, “the draft has not been actioned in any way.”

While the NSIA plays a coordinating role within the security and intelligence community, the bounds of this role are not formally delineated. Furthermore, given their proximity to the Prime Minister, the NSIA’s position on certain actions or decisions may carry considerable weight within the community. As such, the extent of their influence in decisions regarding the distribution of CSIS intelligence products is unclear. Ostensibly, the February 22 decision to “pause” the initial version of the Targeting Paper was made by the Director. In reality, the decision appears to have been made by the NSIA (recall, as an analogous example, the NSIA’s request to recall a CSIS intelligence product about foreign interference in the 2019 election; see paragraph 27, above).

The PCO Special Report and the CSIS Targeting Paper offer interesting parallels. Both products were meant to serve as synthesizing overviews of available intelligence on PRC political foreign interference. In the end, neither report was disseminated to the political executive, for similar reasons. The reports could have been provided for strategic planning purposes to policymakers; instead, the NSIA considered them in terms of the concrete actions/steps which could be taken in light of the intelligence provided and did not disseminate them further. 

There were also questions as to whether the reports actually described foreign interference, or instead recounted standard diplomatic activity, to the point of a flat disagreement in this regard with respect to the Targeting Paper. In assessing intelligence, disagreement and debate are important and healthy. Nonetheless, the delta between CSIS’s point of view and that of the NSIA in this case is significant, because the question is so fundamental. CSIS collected, analyzed, and reported intelligence about activities that it considered to be significant threats to national security; one of the primary consumers of that reporting (and the de facto conduit of intelligence to the Prime Minister) evidently disagreed with that assessment. Commitments to address political foreign interference are straightforward in theory, but will inevitably suffer in practice if rudimentary disagreements as to the nature of the threat persist in the community.

Recommendation 6: NSIRA recommends that Public Safety Canada, Global Affairs Canada, the Privy Council Office, and other regular consumers of intelligence, enhance intelligence literacy within their departments.

Recommendation 7: NSIRA recommends that the security and intelligence community develop a common, working understanding of political foreign interference.

Recommendation 8: NSIRA recommends that the role of the National Security and Intelligence Advisor to the Prime Minister, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Conclusion

The security and intelligence community is of the consensus view that political foreign interference is a significant threat to Canada, and that the PRC is a major perpetrator of this threat at all levels of government. Nonetheless, the present review of how intelligence related to PRC political foreign interference was disseminated from 2018 to 2023 (a period covering the last two federal elections) indicates that there were significant disagreements between constituent components of that community, both within and across organizations, as to whether, when, and how to share what they knew.

Three basic schisms existed. First, within CSIS: the Service struggled to reconcile competing imperatives (report but don’t interfere) given the unique sensitivities of political foreign interference, particularly in and around elections. This resulted in deviations from typical dissemination practices, and corresponding consternation on the part of some intelligence collectors and analysts.

Second, in the “machine” of election security: the SITE Task Force and CEIPP Panel were geared toward broad, systematic interference and therefore could not adequately address so-called traditional, riding-by-riding interference, despite the recognition that this type of threat is the most prevalent in Canada. The Panel’s threshold meant that it did not communicate to the Canadian public about the foreign interference it observed in either the 2019 or 2021 federal elections.

Third, between intelligence analysts and senior public servants: PCO and CSIS analysts produced overviews of what they considered to be PRC foreign interference activities (and therefore threats to national security) but which the NSIA saw as recounting standard diplomatic activity. This fundamental disagreement led, in part, to those intelligence products not reaching the political executive, including the Prime Minister.

These disagreements and misalignments underscore a basic challenge: the so-called “grey zone” whereby political foreign interference may stand in close proximity to typical political or diplomatic activity. This challenge was ever-present in the activities under review, influencing decisions about whether to disseminate and how to characterize what was shared, while raising sensitivities in terms of reporting about activities which skirt the political and diplomatic realms. The risk of characterizing legitimate political or diplomatic behaviour as a threat led some members of the intelligence community to not identify certain activities as threat activities. 

The security and intelligence community grappled with these challenges during a time of significant geopolitical change. Canada’s relationship with the PRC, in particular, has deteriorated since 2018. Not coincidently the trajectory over the review period was toward greater recognition and consensus as to the extent of the threat posed by PRC foreign interference. Yet even as the community comes into alignment, there remain significant impediments to the flow of information about this threat. The recommendations provided in this report address these deficiencies. Their aim, in the end, is to ensure that those receiving intelligence – the decision- and policy-makers ultimately responsible for the security of the country – are able to take effective, informed action.

Annex A. Findings and Recommendations

NSIRA made the following findings and recommendations in this review:

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

Finding 1: NSIRA found that CSIS’s dissemination of intelligence on political foreign interference during the 43rd and 44th federal elections was inconsistent. Specifically, in certain instances:

  • The rationale for decisions regarding whether, when, and how to disseminate intelligence was not clear, directly affecting the flow of information; and
  • The threat posed by political foreign interference activities was not clearly communicated by CSIS.

Finding 2: NSIRA found that CSIS’s dissemination and use of intelligence on political foreign interference was impacted by the concern that such actions could interfere, or be seen to interfere, in the democratic process.

Finding 3: NSIRA found that CSIS often elected to provide verbal briefings as opposed to written products in disseminating intelligence on political foreign interference during elections.

Finding 4: NSIRA found that there was a disconnect within CSIS between a region and National Headquarters as to whether reporting on political foreign interference was subject to higher thresholds of confidence, corroboration and contextualization for dissemination.

Part 2: The SITE Task Force and the CEIPP Panel

Finding 5: NSIRA found that the SITE Task Force and the CEIPP Panel were not adequately designed to address traditional, human-based foreign interference. Specifically:

  • The SITE Task Force focuses on threat activities during the election period, but traditional foreign interference also occurs between elections.
  • Global Affairs Canada’s representation on the SITE Task Force focused on online foreign interference activities.
  • The CEIPP Panel’s high threshold for a public announcement is unlikely to be triggered by traditional foreign interference, which typically targets specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

Finding 6: NSIRA found that the limited distribution of some CSIS and CSE intelligence to senior officials-only reduced the ability of the Royal Canadian Mounted Police, Global Affairs Canada, and the Privy Council Office to incorporate that intelligence into their analysis.

Finding 7: NSIRA found that CSIS and Public Safety did not have a system for tracking who received and read specific intelligence products, creating unacceptable gaps in accountability.

Finding 8: NSIRA found that the dissemination of intelligence on political foreign interference from 2018 to 2023 suffered from multiple issues. Specifically:

  • Intelligence consumers did not always understand the significance of the intelligence they received nor how to integrate it into their policy analysis and decision-making;
  • There was disagreement between intelligence units and senior public servants as to whether activities described in specific intelligence products constituted foreign interference or legitimate diplomatic activity.

Finding 9: NSIRA found that there was disagreement between senior public servants and the NSIA as to whether intelligence assessments should be shared with the political executive. Ultimately, the NSIA’s interventions resulted in two products not reaching the political executive, including the Prime Minister.

Finding 10: NSIRA found that the NSIA’s role in decisions regarding the dissemination of CSIS intelligence products is unclear.

Part 1: CSIS’s collection and dissemination of intelligence on PRC foreign interference in the 2019 and 2021 federal elections

Recommendation 1: NSIRA recommends that CSIS develop, in consultation with relevant government stakeholders, a comprehensive policy governing its engagement with threats related to political foreign interference. This policy should:

  • make explicit CSIS’s thresholds and practices for the communication and dissemination of intelligence regarding political foreign interference. This would include the relevant levels of confidence, corroboration, contextualization and characterization necessary for intelligence to be reported;
  • clearly articulate CSIS’s risk tolerance for taking action against threats of political foreign interference;
  • establish clear approval and notification processes (including external consultations) for all activities related to countering political foreign interference;
  • make clear any special requirements or procedures that would apply during election/writ periods, as necessary, including in particular procedures for the timely dissemination of intelligence about political foreign interference; and,
  • consider best practices from international partners (in particular the Five Eyes) regarding investigating and reporting about political foreign interference.

Part 2: The SITE Task Force and the CEIPP Panel

Recommendation 2: NSIRA recommends that the SITE Task Force align its priorities with the threat landscape, including threats which occur outside of the immediate election period.

Recommendation 3: NSIRA recommends that Global Affairs Canada (GAC) and the Privy Council Office ensure that GAC’s representation on the SITE Task Force leverages the department’s capacity to analyze and address traditional, human-based foreign interference, in addition to the online remit of the Rapid Response Mechanism Team.

Recommendation 4: NSIRA recommends that the Privy Council Office empower the CEIPP Panel to develop additional strategies to address the full threat landscape during election periods, including when threats manifest in specific ridings.

Part 3: The flow of intelligence on PRC foreign interference

Recommendation 5: NSIRA recommends that, as a basic accountability mechanism, CSIS and Public Safety rigorously track and document who has received intelligence products. In the case of highly sensitive and urgent intelligence, this should include documenting who has read intelligence products.

Recommendation 6: NSIRA recommends that Public Safety Canada, Global Affairs Canada, the Privy Council Office, and other regular consumers of intelligence, enhance intelligence literacy within their departments.

Recommendation 7: NSIRA recommends that the security and intelligence community develop a common, working understanding of political foreign interference.

Recommendation 8: NSIRA recommends that the role of the National Security and Intelligence Advisor to the Prime Minister, including with respect to decisions regarding the dissemination of intelligence, be described in a legal instrument.

Share this page
Date Modified:

CSE’s Governance of Active and Defensive Cyber Operations

Date of Publishing:

Executive Summary

The CSE Act provided CSE with the authority to conduct Active and Defensive Cyber Operations (ACO/DCO). As defined by the Act, a DCO stops or impedes foreign cyber threats from Canadian federal government networks or systems deemed by the Minister of National Defence (MND) as important to Canada. On the other hand, ACOs intend to limit an adversary’s ability to affect Canada’s international relations, defence, or security. ACO/DCOs are authorized by Ministerial Authorizations (MA) and, due to the potential impact on Canadian foreign policy, require the Minister of Foreign Affairs (MFA) to either consent or be consulted on ACO and DCO MAs respectively.

In this review, NSIRA set out to assess the governance framework that guides the conduct of ACO-DCOs, and to assess if CSE appropriately considered its legal obligations and the foreign policy impacts of operations. NSIRA analyzed policies and procedures, governance and operational documentation, and correspondence within and between CSE and GAC. The review began with the earliest available materials pertaining to ACO/DCOs and ended concurrently with the validity period of the first ACO/DCO Ministerial Authorizations.

NSIRA incorporated GAC into this review given its key role in the ACO/DCO governance structure arising from the legislated requirement for the role of the MFA in relation to the MAs. As a result, NSIRA was able to gain an understanding of the governance and accountability structures in place for these activities by obtaining unique perspectives from the two departments on their respective roles and responsibilities.

The novelty of these powers required CSE to develop new mechanisms and processes while also considering new legal authorities and boundaries. NSIRA found that considerable work has been conducted in building the ACO/DCO governance structure by both CSE and GAC. In this context, NSIRA has found that some aspects of the governance of can be improved by making them more transparent and clear.

Specifically, NSIRA found that CSE can improve the level of detail provided to all parties involved in the decision-making and governance of ACO/DCOs, within documents such as the MAs authorizing these activities and the operational plans that are in place to govern their execution. Additionally, NSIRA found that CSE and GAC have not sufficiently considered several gaps identified in this review, and recommended improvements relating to:

  • The need to engage other departments to ensure an operation’s alignment with broader Government of Canada priorities,
  • The lack of a threshold demarcating an ACO and a pre-emptive DCO,
  • The need to assess each operation’s compliance with international law, and
  • The need for bilateral communication of newly acquired information that is relevant to the risk level of an operation.

The gaps observed by NSIRA are those that, if left unaddressed, could carry risks. For instance, the broad and generalized nature of the classes of activities, techniques, and targets [**redacted**] ACO/DCOs can capture unintended [**redacted**] activities and targets. Additionally, given the difference in the required engagement of GAC in ACOs and DCOs, misclassifying what is truly an ACO as a pre-emptive DCO could result in a heightened risk to Canada’s international relations through the insufficient engagement of GAC.

While this review focused on the governance structures at play in relation to ACO/DCOs, of even greater importance is how these structures are implemented, and followed, in practice. We have made several observations about the information contained within the governance documents developed to date, and will subsequently assess how they are put into practice as part of our forthcoming review of ACO/DCOs.

The information provided by CSE has not been independently verified by NSIRA. Work is underway to establish effective policies and best practices for the independent verification of various kinds of information, in keeping with NSIRA’s commitment to a ‘trust but verify’ approach.

Authorities

This review was conducted pursuant to paragraphs 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency (NSIRA) Act.

Introduction

Review background and methodology

With the coming into force of the CSE Act on August 1, 2019, CSE received the authority to independently conduct Active and Defensive Cyber Operations (“Active and Defensive Cyber Operations,” or ACO/DCOs henceforth) for the first time. While initial briefings on the subject in late fall of 2019 conveyed to NSIRA [**relates to CSE operations**] CSE later explained that [**redacted**].In this context, NSIRA will be assessing ACO/DCOs in a staged approach. The objective of this review is to better understand CSE’s development of a governance structure for ACO/DCOs. NSIRA will follow up with a subsequent review of the operations. This subsequent review is underway, with completion expected in 2022.

This review pertained to the structures put in place by CSE to govern the conduct of ACO/DCOs. Governance in this context can pertain to the establishment of processes to guide and manage planning, inter-departmental engagement, compliance, training, monitoring, and other overarching issues that affect the conduct of ACO/DCOs. NSIRA recognizes that these structures may be revised over time based on lessons learned from operations. Canada’s allies, who have had similar powers to conduct cyber operations for many years, [**relates to foreign partners’ capabilities**]. In this context, as its objectives, NSIRA sought out to determine if, in developing a governance structure for ACO/DCOs at this early stage, CSE appropriately considered and defined its legal obligations, and the foreign policy and operational components of ACO/DCOs.

As part of this governance review, NSIRA assessed policies, procedures, governance and operational planning documents, risk assessments, and correspondence between CSE and GAC (whose key role in this process is described below). NSIRA reviewed the earliest available materials relating to the development of the ACO/DCO governance structure, with the review period ending concurrent with the validity period of the first ACO/DCO Ministerial Authorizations on August 24, 2020. As such, the findings and recommendations made throughout this report pertain to the governance structure as it was presented during the period of review.

What are Active and Defensive Cyber Operations?

As defined in the CSE Act, Defensive Cyber Operations (DCOs) are those that stop or impede foreign cyber threats before they reach Canadian federal government systems or networks and systems designated by the Minister of National Defence (MND) as being of importance to Canada, such as Canada’s critical infrastructures and registered political parties. Active Cyber Operations (ACOs), on the other hand, allow the government to use CSE’s online capabilities to undertake a range of activities in cyberspace that limit an adversary’s ability to negatively impact Canada’s international relations, defence, or security, without their knowledge or consent. ACOs can include, for example, activities that disable communications devices used by a foreign terrorist network to communicate or plan attacks. The impacts of ACO/DCOs, [**relates to CSE operations**] of an ACO/DCO.

To conduct ACO/DCOs, CSE relies on its existing access to the global information infrastructure (GII), foreign intelligence expertise, and domestic and international partnerships to obtain relevant intelligence to support the informed development of ACO/DCOs. Activities conducted under CSE’s foreign intelligence and cybersecurity mandates allow CSE to gather information related to the intent, plans, and activities of actors seeking to disrupt or harm Canadian interests. According to CSE, the preliminary gathering of intelligence, capability development, [**redacted**] comprises the majority of the work necessary to conduct an ACO/DCO whereas the resulting activity in cyberspace is considered to be [**redacted**] of the task.

Legal foundation for conducting cyber operations

The CSE Act provides the legal authority for CSE to conduct ACO/DCOs, and these aspects of the mandate are described in the Act as per Figure 1. The ministerial authorization regime in the CSE Act provides CSE with the authority to conduct the activities or classes of activities listed in section 31 of the CSE Act in furtherance of the ACO/DCO aspects.

Defensive Cyber Operations (DCOs)

  • Section 18 of the CSE Act
  • The defensive cyber operations aspect of the Establishment’s mandate is to carry out activities on or through the global information infrastructure to help protect
    • (a) federal institutions’ electronic information and information infrastructures; and
    • (b) electronic information and information infrastructures designated … as being of importance to the Government of Canada.

Active Cyber Operations (ACOs)

  • Section 19 of the CSE Act
  • The active cyber operations aspect of the Establishment’s mandate is to carry out activities on or through the global information infrastructure to degrade, disrupt, influence, respond to, or interfere with the capabilities, intentions, or activities of a foreign individual, state, organization, or terrorist group as they relate to international affairs defence or security.

Importantly, the Act limits ACO/DCOs in that they cannot be directed at Canadians or any person in Canada and cannot infringe on the Charter of Rights and Freedoms; nor can they be directed at any portion of the GII within Canada.

ACO/DCOs must be conducted under a Ministerial Authorization (MA) issued by the MND under subsection 29(1) (DCO) or under subsection 30(1) (ACO) of the CSE Act.  ACO/DCO MAs permit CSE to conduct ACO/DCO activities despite any other Act of Parliament or of any foreign state. In order to issue an MA, the MND must conclude that there are reasonable grounds to believe that any activity is reasonable and proportionate, and must also conclude that the objective of the cyber operation could not reasonably be achieved by other means. In addition, the MND must consult with the Minister of Foreign Affairs (MFA) in order to issue DCO MAs, and must obtain the MFA’s consent in order to issue ACO MAs. Any authorized ACO/DCO activities cannot cause, intentionally or by criminal negligence, death or bodily harm to an individual; or willfully attempt in any manner to obstruct, pervert, or defeat the course of justice or democracy. Importantly, unlike the MAs issued under the foreign intelligence, and cybersecurity and information assurance aspects of CSE’s mandate, ACO and DCO MAs are not subject to approval by the Intelligence Commissioner.

In addition to the ACO/DCO aspects of its mandate, CSE may also conduct ACO/DCO activities through technical and operational assistance to other Government of Canada (GC) departments. CSE may assist federal law enforcement and security agencies (LESAs) for purposes such as preventing criminal activity, reducing threats to the security of Canada, and supporting GC- authorized military missions. When providing assistance, CSE operates entirely within the legal authorities and associated limitations of the department requesting the assistance. Similarly, persons acting on CSE’s behalf also benefit from the same exemptions, protections and immunities as persons acting on behalf of the requesting LESAs. These assistance activities will be reviewed in subsequent NSIRA reviews.

In addition to the CSE Act, international law forms part of the legal framework in which ACO/DCO activities are conducted. Customary international law is binding on CSE’s activities, as Canadian law automatically adopts customary international law through the common law, unless there is conflicting legislation.

NSIRA notes that international law in cyberspace is a developing area. There is limited general state practice, or opinio juris (i.e, state belief that such practice amounts to a legal obligation), or treaty law, which elaborates on how international law applies in the cyber context. Moreover, while Canada has publically articulated that international law applies in cyberspace, it has not articulated a position on how it believes international law applies in cyberspace. At the same time, Canada has committed to building a common understanding between states of agreed voluntary non-binding norms of responsible state behaviour in cyberspace. NSIRA will closely monitor this emerging area of international law, including State practice in relation to CSE’s ACO/DCO activities – particularly in assessing CSE and GAC’s consideration of applicable international law as part of our subsequent review of ACO/DCOs.

Policy framework guiding cyber operations

Development of GAC-CSE framework for consultation

Conducting ACO/DCOs may elevate risks to Canada’s foreign policy and international relations. While CSE’s foreign intelligence mandate seeks only to collect information, ACO/DCOs [**redacted**]. As GAC is the department responsible for Canada’s international affairs and foreign policy, the MFA has a legislated role to play in consenting to MND’s issuance of an ACO Ministerial Authorization.

As directed by the MFA, CSE and GAC worked together to develop a framework for collaboration on matters related to ACO/DCOs. CSE and GAC began to engage on these matters before the coming into force of the CSE Act to proactively address the consultation and consent requirements embedded in the Act. Together, CSE and GAC have developed various interdepartmental bodies related to ACO/DCOs to facilitate consultation at different levels, including working groups at the levels of Director General and Assistant Deputy Minister.

CSE Governance Structure

CSE’s Mission Policy Suite (MPS) details the authorities in place to guide ACO/DCOs, prohibited activities when conducting ACO/DCOs and guidance in interpreting these prohibitions, as well as the governance framework to oversee the development and conduct of ACO/DCOs – known as the Joint Planning and Authorities Framework (JPAF). The general structure of this governance framework and process is intended to be used for all ACO/DCOs, irrespective of their risk-level. However, depending on the risk level of the operations, the framework sets out the specific approval levels.

During the period of review, the JPAF comprised several components required to plan, approve, and conduct cyber operations. The primary planning instrument for ACO/DCOs was [**relates to CSE operations**] that detailed the [**redacted**] identified [**redacted**] and highlighted risks and mitigations. [**redacted**] is used to determine and enumerate a range of risks associated with any new activity. In this period, CSE developed [**redacted**] NSIRA also received these documents [**redacted**] that fell slightly outside the review period, but provided relevant insight into the governance structure at the operation level.

Two primary internal working groups exist to evaluate and approve CSE’s internal plans for ACO/DCOs. The Cyber Operations Group (COG) is a Director-level approval body composed of key stakeholders and is chaired by the Director of the operational area that has initiated or sponsored a cyber operations request. The role of the COG is to review the operational plan and assess any associated risks and benefits. The COG may approve a [**redacted**] or may defer approval to the CMG as appropriate. The Cyber Management Group (CMG) is a Director General (DG) level approval body that is formed [**redacted**] has been reviewed and recommended by the COG.

CSE then develops the [**relates to CSE operations**] is reviewed internally to ensure it aligns [**redacted**] and is later approved at the Director level, although CSE has indicated it could be subject to delegation to a Manager.

Findings and Recommendations

Clarity of Ministerial Authorizations

NSIRA set out to assess whether the requirements of the CSE Act in relation to ACO/DCOs are appropriately reflected in the MND’s MAs authorizing ACO/DCO activities, and that CSE appropriately consulted or received the consent of the MFA, as required by the Act.

NSIRA reviewed two MAs related to ACOs and DCOs, respectively, which were valid from [**redacted**]. Notably, both MAs only approved [**redacted**] ACO/DCOs. Additionally, NSIRA reviewed documentation supporting the MAs, including the Chief’s Applications to the MND and the associated confirmation letters from the MFA, as well as working- level documents and correspondence provided by both CSE and Global Affairs Canada (GAC).

The MAs examined by NSIRA outlined the new authorities found in the CSE Act, and set conditions on how ACO/DCOs are to be conducted, including the prohibitions that are found in the Act. Additionally, the MAs required that ACO/DCO activities align with Canada’s foreign policy priorities and respond to Canada’s national security, foreign, and defence policy priorities as articulated by the GC.

Supporting cyber operations with information collected under previous authorizations

CSE received its authority to conduct ACO/DCOs during a time when CSE’s collection of foreign signals intelligence (SIGINT) was authorized by MAs issued under the National Defence Act (NDA). [**redacted**]. CSE confirmed to NSIRA that the ACO/DCOs [**redacted**] relied solely on information collected under CSE Act MAs. CSE explained that [**redacted**] NSIRA will confirm this as part of our subsequent review of specific ACO/DCOs.

CSE’s consultation with the Minister of Foreign Affairs

CSE provided GAC with the full application packages for the ACO/DCO MAs in place during the review period. Further, GAC and CSE officials engaged at various levels prior to the coming into force of the CSE Act, and during the development of the MAs – particularly in assessing the classes of activities authorized within them. In response to CSE’s MA application package, the MFA provided letters acknowledging her consultation and consent on the DCO and ACO MAs respectively. NSIRA welcomes this early and rigorous engagement on the part of both departments, given the intersection of their respective mandates in the context of ACO/DCOs.

Both letters from the MFA note the utility of ACO/DCOs [**redacted**] for the GC, articulating the importance of approaching this capability with caution in the initial stages. Notably, the MFA highlights the “carefully defined” classes of activities defined in the ACO MA as assurance that the activities authorized under the MA presented [**redacted**]. Finally, the MFA directed her officials to work with CSE to establish a framework for collaboration on [**redacted**] This direction from the MFA aligns with GAC’s view of the importance of ensuring CSE’s activities would be coherent with Canada’s foreign policy, and that either the MA or another mechanism should provide for that.

Scope and breadth of the Ministerial Authorizations

[**relates to CSE operational policy**] ACO MA issued under section 31 of the CSE Act authorized classes of activities such as:

  • [**redacted**] interfering with a target’s [**redacted**] or elements of the global information infrastructure (GII);
  • [**redacted**]
  • [**redacted**]
  • disrupting a cyber threat actor’s ability to use certain infrastructure.

[**redacted**] DCO MA authorized the same activities, except for the last class of activities, [**relates to CSE operations**].

Both of the ACO/DCO MAs required CSE to conduct ACO/DCOs [**in a certain way**]. According to the ACO MA, it is these conditions, if met, that would make ACO/DCOs conducted under these MAs [**redacted**]. While GAC assesses While GAC assesses foreign policy risks at a more operational level, the MAs developed in the review period only required these two conditions to be met when conducting ACOs or DCOs. Further, the specifics of how to meet these broad conditions are left to CSE’s discretion, and the MA only requires CSE to self-report this. NSIRA further notes that these conditions do not include foreign policy variables, [**redacted**]. To confirm [**redacted**] foreign policy risk associated with an operation, NSIRA believes it is important that the MAs stipulate the calculation of foreign policy risk factors.

[**redacted**] stating that:

[**redacted**]

CSE appears to have responded to [**relates to CSE operations**]. This may also impact the Minisiter’s ability to assess any authorized activities as stipulated in the CSE Act, which requires sufficient precision in an MA application for the Minister to satisfy these requirements.

The classes of ACO/DCO activities, some of which are detailed in paragraph 27, are highly generalized. For instance, nearly any activity conducted in cyberspace can be feasibly classed as [**redacted**] interfering with elements of the global information infrastructure.” [**relates to CSE operations**]

Indeed, early discussions between CSE and GAC highlighted that the activity of [**redacted**] and content “raises difficult questions,” though NSIRA notes that such an activity is nevertheless authorized in the final ACO MA in the activity class of [**redacted**]. In short, the authorization for a class of activities [**redacted**] was incorporated into an even broader class of activities, without any evident [**redacted**] previously associated with it. This type of categorization does not sufficiently communicate information to the Minister to appreciate [**redacted**] activities that could be carried out under the MA.

By contrast, the techniques and associated examples outlined in the Applications are the only means through which it is clarified what types of activities could be taken as part of an ACO/DCO. These examples provide the basis for the MND to assess the classes of activities requested in the MA. Early correspondence between CSE and GAC saw the classes of activities described and analyzed in tandem with the techniques that would enable them. For instance, it was noted that [**relates to CSE operations**] which NSIRA found more informative with respect to what specific actions were captured within the class of activities. NSIRA further notes that even these techniques and examples are described in the Applications as a non-exhaustive list, potentially enabling CSE to conduct activities that are not clearly outlined in the Applications.

Similarly, the target of ACO/DCO activities is typically identified as ‘foreign actor,’ which could encompass a wide range of [**redacted**] In the early stages of MA development, CSE and GAC had discussed [**relates to CSE operations**] within the MAs, and GAC specified that the intent of [**redacted**] was to focus on [**redacted**] given the [**redacted**]. GAC also noted that the ACO MA “would [more] clearly define [**redacted**] to some extent. Neither of these considerations were reflected in the final [**redacted**] MAs, which CSE explained “are not limited to activities [**redacted**] meaning that [**redacted**]. NSIRA believes that the MAs should carefully define targets of ACO/DCO activities [**redacted**]. ACO/DCOs to specific target sets [**redacted**] to ensure that the activities permitted by the MA are reflective of its [**redacted**].

NSIRA notes that only the MAs, and not the associated Applications, authorize CSE to conduct its activities. As such, the exclusion of this information from the MAs means that only the broad classes of activities, as described in the MAs, guide the actions that CSE can take in conducting an ACO/DCO, and not the techniques and examples in the Applications that help justify the standard on which the risk of the activities is based. NSIRA does not believe that the classes of activities as described within the MAs sufficiently limit CSE’s activities [**relates to CSE operations**]. Even though, as explained by GAC, interdepartmental consultative processes between the two departments may serve as a mechanism to limit CSE’s activities, these processes were not explicitly recorded in the MAs authorizing them. NSIRA believes more precise ACO/DCO MAs will minimize the potential for any misunderstanding regarding the specific activities authorized.

The approach of specifying broad classes of activities is in line with CSE’s general practice of obtaining broad approvals from senior levels such as the Minister, with more specific internal controls guiding the operations to be conducted within the scope of the approved activity. According to GAC, it tends to rely on more specific approvals based on the [**redacted**] for which approval is sought. CSE offered that its approach allows CSE to obtain approval for activities in such a way that “enables flexibility to maximize opportunities, but with enough caveats to ensure risks are appropriately mitigated.”

While NSIRA acknowledges that MAs should be reasonably nimble to enable CSE to conduct [**redacted**]. ACO/DCOs should the need arise, it is important that CSE does not conduct activities that were not envisioned or authorized by either the MND or MFA in the issuance of the applicable MAs. NSIRA believes that in the context of [**redacted**] ACO/DCOs, CSE can adopt a more transparent approach that would make clearer the classes of activities it requests the Minister to authorize. This is especially important given the early stage of CSE’s use of these new authorities. By authorizing more precise classes of activities, associated techniques, and intended target sets ACO/DCOs would be less likely to [**redacted**] of the MAs.

CSE has stated that, “being clear about objectives is critical for demonstrating reasonableness and proportionality.” NSIRA shares this view, and believes that the classes of activities and the objectives described in the MAs and their associated Applications should be more explicit for the MND to be able to conclude on reasonableness and proportionality of ACO/DCOs – particularly given that the MAs assessed as part of this review were not specific to an operation. As part of the Authorization, the Minister also requires CSE to provide a quarterly retroactive report on the activities conducted. Moreover, to issue an authorization, the MND must be satisfied that the activities are reasonable and proportionate, and that there are reasonable grounds to believe that the objective of the cyber operation could not reasonably be achieved by other means. This requirement further points toward a need for the MND to appreciate, with a certain degree of specificity, the types of activities and objectives that will be carried out under the authorization.

In both of the MAs reviewed, the Minister concluded that the requirements set out within s. 34(4) of the CSE Act are met. Further, the MAs set out the objectives to be met in the conduct of ACO/DCOs. However, the rationale offered that the objectives could not be reasonably achieved by other means within the ACO MA is quite broad and focuses on general mitigation strategies for cyber threat activities. The paucity of detail provided to the Minister under the current framework could make it challenging for the MND to meet this legislative requirement. In relation to the thresholds of s. 34(4) of the CSE Act, CSE has indicated that “the application for the Authorization, must set out the facts that explain how each of the activities described in the Authorization are part of a larger set of individual activities or part of a class of activities that achieves an objectives that could not reasonably be achieved by other means.” In our subsequent review of ACO/DCOs, NSIRA will assess whether specific ACO/DCOs aligned with the objectives of the MA, and CSE’s determination that they could not have reasonably been achieved by other means.

Finding no. 1: The Active and Defensive Cyber Operations Ministerial Authorization Applications do not provide sufficient detail for the Minister(s) to appreciate the scope of the classes of activities being requested in the authorization. Similarly, the Ministerial Authorization does not sufficiently delineate precise classes of activities, associated techniques, and intended target sets to be employed in the conduct of operations.

Finding no. 2: The assessment of the foreign policy risks required by two conditions within the Active and Defensive Cyber Operations Ministerial Authorizations relies too much on technical attribution risks rather than characteristics that reflect Government of Canada’s foreign policy.

Recommendation no. 1: CSE should more precisely define the classes of activities, associated techniques, and intended target sets to be undertaken for Active and Defensive Cyber Operations as well as their underlying rationale and objectives, both in its Applications and associated Ministerial Authorizations for these activities.

Recommendation no. 2: GAC should include a mechanism to assess all relevant foreign policy risk parameters of Active and Defensive Cyber Operations within the associated Ministerial Authorizations.

[**redacted**] approach to MA application development

During the review period, CSE only developed MA applications for what it considered [**redacted**]. ACO/DCOs, which were first prioritized for development [**related to CSE operations**]. As CSE’s capacity to conduct ACO/DCOs matures and it begins to [**redacted**]. NSIRA has observed CSE and GAC exploring the idea of [**redacted**] ACOs, which, if pursued, would [**redacted**] based on GAC’s methodology.

While the MAs obtained to date, which are not specific to an operation, allow CSE to act in [**redacted**]. NSIRA believes their generalized nature is not transferable to [**potential MAs of a different nature**]. For instance, [**description of an NSIRA concern about the Minister’s ability to filly assess certain factors about cyber operations in a certain context**]. In the context of the development of the 2019-20 ACO MA Application, GAC noted, “other purposes would require other MAs. They will not be completely general; they will be specific to a context.

Further, under the current legislative scheme, the MA Applications are a key mechanism through which the MFA has an opportunity to assess ACO/DCO activities. Because of the [**redacted**] ACO/DCOs to Canada’s foreign policy and international relations, NSIRA believes the MFA should be more directly involved in their development and execution at the Ministerial level, in addition to the working level engagement that takes place between CSE and GAC. Both Ministers can more effectively take accountability for such operations through individual MAs that provide specific details relating to the operation, its rationale, and the activities, tools, and techniques that will enable it. As such, when CSE [**redacted**] ACOs, NSIRA encourages CSE to develop MA Applications that are specific to these operations, and ensure these documents contain all the pertinent operational details that would allow each Minister to fully assess the implications and risks of each cyber operation and take accountability for it.

Strategic direction for cyber operations

Section 19 of the CSE Act directs CSE’s authority to conduct ACOs in relation to international affairs, defence, or security, all areas that could implicate the responsibility of other departments. Additionally the MAs reviewed by NSIRA require that ACOs “align with Canada’s foreign policy and respond to national security, foreign, and defence policy priorities as articulated by the Government of Canada.” The setting of these priorities involve a wide range of GC departments, including the Privy Council Office (PCO), the Department of National Defence (DND), and Public Safety Canada (PS) – which are responsible for coordination and oversight of different parts of priority setting in this context. Throughout this governance review, it emerged that CSE confirms compliance with these requirements with a statement that the MA meets broader GC priorities with no elaboration of how these priorities are met.

Interdepartmental GC processes are not new in the context of coordinating national security activities and operations. As one example, when the MFA requires foreign intelligence collection within Canada, he or she submits a request to the Minister of Public Safety for this collection to be facilitated by the Canadian Security Intelligence Service (CSIS) in accordance with section 16 of the CSIS Act. A Committee consisting [**redacted**] subsequently considers this type of request. The Committee considers issues at the Assistant Deputy Minister level, [**relates to GC decision making processes**]. Similarly, ensuring an ACO’s alignment with broader priorities and that it could not reasonably be achieved by other means can also be confirmed through an interdepartmental process. In other words, interdepartmental consultations are a means to assess the objectives of ACOs, their alignment with broader GC priorities, as well as whether there are other means by which to achieve the set objectives, as required by the CSE Act.

The setting of broader GC priorities and objectives for ACOs emerged as a key component of the governance structure for this new power in early discussions between CSE and GAC. During the period of review, CSE developed ACOs with GAC participating in some aspects of the planning process. GAC encouraged the MFA to request the development of a governance mechanism to mitigate the risk that “CSE could decide, on their own, to engage [**redacted**] noting that [**redacted**].

Early internal GAC assessments contrast this with CSE’s foreign intelligence mandate, which responds to Cabinet-approved intelligence priorities, and captured the essence of this discrepancy in stating:

[**quotation from GAC that reflects discussion related to strategic objectives and priorities of cyber operations**]

In another instance, GAC described the setting of such priorities as an “important issue that has not yet been agreed to with CSE,” and explained its view at the time, that a body with a mandate relevant to the cyber operation should decide if it is the appropriate tool to achieve a particular objective. GAC explained that its officials eventually agreed to move forward without pursuing this matter as long as a governance mechanism was established with CSE.

In this context, s. 34(4) of the CSE Act requires that the objectives of the cyber operation could not be reasonably attained by other means, and that cyber operations respond to priorities in various subject areas. Given these requirements, NSIRA notes that GC departments, other than just CSE and GAC, may be able to provide meaningful insight regarding other options or ongoing activities that could achieve the same objectives.

Furthermore, GAC highlighted the fact that Cabinet sets the Standing Intelligence Requirements (SIRs) that limit and more narrowly direct CSE’s foreign intelligence collection activities. When asked about this issue, CSE responded that “these discussions led both GAC and CSE to agree to begin with a [**redacted**] Ministerial Authorization supported by the CSE-GAC ACO/DCO consultation structure and governance framework.”

In NSIRA’s view, the CSE Act and the ACO MA directly relate ACOs to broader GC objectives and priorities that directly implicate the mandates of departments such as DND, PCO, CSIS, and PS, in addition to those of CSE and GAC. It is not sufficient for CSE to state that an MA and its associated activities align with these priorities without elaboration or consultation of any other parties, given that Canada’s national security and defence policy priorities are under the remit or coordination of DND, PCO, and PS. These departments would be best positioned to comment on, and confirm, a specific ACO’s alignment with Canada’s goals in order to mitigate the potential risks associated with these operations and contribute to overall accountability of these operations.

[**relates to GC national security matters**] As such, the governance process merits the inclusion of – or at the very least consultation with – other departments whose mandates are to oversee Canada’s broader strategic objectives. This could ensure that Canada’s broader interests and any potential risks have been sufficiently considered and reflected in the development of ACOs.

Finding no. 3: The current governance framework does not include a mechanism to confirm an Active Cyber Operation’s (ACO) alignment with broader Government of Canada (GC) strategic priorities as required by the CSE Act and the Ministerial Authorization. While these objectives and priorities that are outside CSE and GAC’s remit alone, the two departments govern ACOs without input from the broader GC community involved in managing Canada’s overarching objectives.

Recommendation no. 3: CSE and GAC should establish a framework to consult key stakeholders, such as the National Security and Intelligence Advisor to the Prime Minister and other federal departments whose mandates intersect with proposed Active Cyber Operations to ensure that they align with broader Government of Canada strategic priorities and that the requirements of the CSE Act are satisfied.

Threshold for conducting pre-emptive DCOs

CSE differentiates between DCOs initiated in response to a cyber threat, and DCOs issued pre-emptively to prevent a cyber threat from manifesting. Further, CSE and GAC have discussed the nature of these operations, including that they exist on a spectrum ranging from operations which are responsive, to those which can be proactive in nature. Notably, in the case of DCOs, [**relates to CSE operations**].

CSE has explained that the initiation of a DCO “requires evidence of a threat that represents a source of harm to a federal institution or designated electronic information or information infrastructure.” In CSE’s view, this threat does not need to compromise the infrastructure before a DCO be initiated so long as evidence establishes a connection between the two.

At the same time, CSE has not yet developed a means to distinguish between this type of DCO and an ACO, given that discussions between GAC and CSE noted that a DCO could resemble an ACO when it is conducted proactively. Unlike ACOs, which require the consent of the MFA and result in a comprehensive engagement of GAC throughout the planning process, DCOs only require consultation with the MFA. Without a clear threshold for a proactive DCO, the potential exists for insufficient involvement of GAC in an operation that could resemble (or constitute) an ACO, [**redacted**].

In our subsequent review, we will pay close attention to the nature of any pre-emptive DCOs planned and/or conducted to ensure that they do not constitute an ACO.

Finding no. 4: CSE and GAC have not established a threshold to determine how to identify and differentiate between a pre-emptive Defensive Cyber Operation and an Active Cyber Operation, which can lead to the insufficient involvement of GAC if the operation is misclassified as defensive.

Recommendation no. 4: CSE and GAC should develop a threshold that discerns between an Active Cyber Operation and a pre-emptive Defensive Cyber Operation, and this threshold should be described to the Minister of National Defence within the applicable Ministerial Authorizations.

Collection of information as part of a cyber operation

Under s. 34(4) of the CSE Act, the MND only issues an authorization if he or she concludes that no information will be acquired under the authorization except in accordance with an authorization issued under ss. 26(1) or 27(1) or (2) or 40(1). The ACO/DCO MAs issued under the period of review reflect this restriction. The ACO/DCO MAs and corresponding applications only mention that existing foreign intelligence MAs will be used to acquire information to support ACO/DCO activities. It further articulates that no information will be acquired in the conduct of ACO/DCO activities which are authorized under the ACO MA.

However, the MAs and the supporting applications do not describe the full extent of information collection activities resulting from ACO/DCOs. According to CSE policy, CSE is still permitted to collect information [**redacted**] so long as this activity is covered under another existing MA. CSE explained that ACO/DCO MAs cannot be relied on to facilitate intelligence collection, however [**relates to CSE operations**]. For example, [**redacted**] using the applicable Foreign Intelligence (FI) authority to [**redacted**] in accordance with GC intelligence priorities.

Although the CSE Act permits CSE to acquire information pursuant to collection MAs, NSIRA believes that CSE’s policy to allow collection activities under different MAs during the conduct of cyber operations is not accurately expressed within the ACO/DCO MAs. Instead, the collection of information is listed under prohibited conduct within the ACO MA, giving the impression that collection cannot occur under any circumstances. As a result, NSIRA notes that the way in which the ACO MA is written does not provide full transparency of CSE’s own internal policies.

CSE explained that [**redacted**] during an ACO/DCO. Further, NSIRA learned from a CSE subject-matter expert (SME) that a specific [**redacted**] which outlines the precise activities to be undertaken as part of the operation, guides each ACO/DCO. [**relates to CSE operations**].

Given CSE’s policy of allowing collection and cyber operations to occur simultaneously [**redacted**]NSIRA will closely review the roles and responsibilities [**redacted**] involved in ACO/DCOs, as well as the technical aspects of using CSE’s systems in support of ACO/DCOs, in our subsequent review of specific operations conducted by CSE to date.

Finding no. 5: CSE’s internal policies regarding the collection of information in the conduct of cyber operations are not accurately described within the Active and Defensive Cyber Operations Ministerial Authorizations.

Recommendation no. 5: In its applications to the Minister of National Defence, CSE should accurately describe the potential for collection activities to occur under separate authorizations while engaging in Active and Defensive Cyber Operations.

Internal CSE Governance

NSIRA set out to assess whether CSE’s internal governance process sufficiently incorporates all the necessary considerations in the planning and execution of the operations and, whether those implicated in the conduct of ACO/DCOs (i.e. GAC and [**redacted**]) are adequately informed of the parameters and limitations pertaining to cyber operations.

During the period of review, CSE operationalized its requirements in the CSE Act and MAs through various internal planning and governance mechanisms. These ranged from strategic, high-level planning documents and mechanisms to the individual operational [**documents/mechanisms**] of each ACO/DCO.

Governance of operations

As described earlier, CSE uses various planning and governance documentation in the approval process for individual ACO/DCOs, including the [**redacted**] CSE first develops the [**redacted**] an ACO/DCO. Following this, CSE creates a [**redacted**] which outlines the risks to be considered in conducting the ACO/DCO. Additionally, the [**redacted**] and the [**redacted**] both generally include fields relating to the prohibitions set out within the CSE Act. Once a specific target is chosen, the [**redacted**] serves as the final governance document, prior to the [**redacted**] of an ACO/DCO.

Similar to the ACO/DCO MAs, as an initial operational plan, the [**redacted**] generally preapproves a set of activities and a generalized [**redacted**] which are then further refined and developed as part of the [**redacted**] process. In NSIRA’s view, [**relates to CSE operations**].

Specifically, the [**relates to CSE operations**] and other operational details that, in NSIRA’s view, surpass simply [**redacted**] and contain key components of operational planning. [**redacted**] details the specific [**redacted**]. Nonetheless, despite the [**redacted**] the [**redacted**] it may have a lower approval threshold than that of the [**redacted**].

Overall, NSIRA welcomes that CSE has developed procedures and documented its operational planning associated with ACO/DCO activities, in accordance with its requirements in the MPS. Nonetheless, the numerous governance documents that comprise the governance of ACO/DCOs exist to serve different audiences and purposes, and result in pertinent information dispersed across them, rather than being available in a unified structure for all implicated stakeholders and decision- makers to assess. NSIRA believes the many separate components of governance may be redundant and result in unnecessary ambiguity within the same operational plans that are meant to guide ACO/DCOs. Thus, NSIRA will assess the efficacy of this governance structure as it is applied to operations as part of our subsequent review.

Finding no. 6: The [**redacted**] process, which occurs after planning documents have been approved, contains information that is pertinent to CSE’s broader operational plans. The at [**redacted**] times contained pertinent information absent from these other documents, even though it is approved at a lower level of management.

Recommendation no. 6: CSE should include all pertinent information, including targeting and contextual information, within all operational plans in place for a cyber operation, and in materials it presents to GAC.

Training on the new framework for cyber operations

Both the ACO and DCO Ministerial Authorizations authorize the following classes of persons to conduct ACO/DCO activities: [**relates to CSE’s operational policy**]. The MAs further require that these “persons or classes of persons must operationally support CSE and Government of Canada intelligence requirements, and demonstrate an understanding of the relevant legal and policy requirements.”

Further demonstrating a commitment to the training and education of its operational staff of the new legal and policy requirements, CSE has stated—with respect to a specific operation—that:

The operational activities undertaken [**redacted**] who receive extensive and continuous training on their function and duties as well as the policy considerations and compliance requirements for their specific role. Additionally, [**redacted**] are trained and accountable for the activities they are carrying out, including all relevant compliance reporting requirements. [**redacted**] performing activities [**redacted**] are also provided, in advance, all related operational materials to ensure the operational conditions outlined within are understood and adhered to.

Finally, CSE explained to NSIRA that “prior to the new Act being approved, CSE provided virtual and in-person briefings on the new authorities to all of CSE’s workforce. More tailored briefings were available for operational teams.” These included presentations and question-and-answer sessions with the Deputy Chief, Policy and Communications and other briefing sessions created by CSE’s policy teams. However, NSIRA notes these types of training sessions, while educational at a high level, are not operation-specific and do not test employees understanding of their new legislative operating environment.

Based on the above requirements and assurances, NSIRA expected to find that CSE employees supporting ACO/DCOs were provided with sufficient and effective training to thoroughly understand their responsibilities in light of CSE’s new legal authorities and constraints, and to apply this knowledge in the delivery of ACO/DCOs.

In this context, CSE conducted a tabletop exercise with a view to introduce [**certain employees**] to the MA design process at an early stage, to enlist their involvement in the drafting of MAs, and to test the functional viability of the MA framework, among other objectives. Throughout the exercise, [**the above mentioned employee**] barred from seeking advice from policy and legal representatives for management to be able to observe results as they may naturally occur. NSIRA notes a key observation from the exercise:

[**redacted**] expressed unease with the need to rely on multiple MAs to support evolving mission objectives. Policy guidance and training will be needed to [**redacted**] to know what authority they are operating under as they proceed with an operation across missions and across MAs. This guidance and training must also account for the fact that information collected under different MAs could be subject to different data management requirements.

CSE stated that [**certain employees**] obtain knowledge of the legal authorities, requirements, and prohibitions of an ACO or DCO through planning meetings and knowledge of the operational documents. In an interview with a CSE SME [**redacted**] NSIRA learned that the training offered on CSE’s new legal authorities, requirements, and prohibitions [**redacted**]. The SME said that if they had any questions about the governance, they would [**relates to CSE operations**].

It is unclear to NSIRA whether there exists a requirement for [**redacted**] to thoroughly understand the parameters delineated for an ACO/DCO within the [**redacted**]. For instance, when asked about their comfort level of operating under different MAs [**redacted**] contained in the [**redacted**] CSE explained that [**redacted**] are developed from the [**redacted**], but as described [**redacted**]. NSIRA is concerned that if [**certain employees**] are focused primarily on the [**certain document/mechanism**] they may not have an adequate understanding of the broader parameters and restrictions associated with an operation.

The MAs authorizing ACO/DCOs impose a condition on CSE’s employees involved in the execution of ACO/DCOs to demonstrate an understanding of the legal and policy requirements under which they operate. The MAs and operational planning documents contain valuable information about the parameters of the broader authority to conduct ACO/DCOs and specific operations. As such, NSIRA believes it is imperative that employees working on any aspect of delivering an ACO/DCO receive thorough training sessions to familiarize them with the requirements and limitations of their respective operations set out in the [**redacted**] and [**redacted**]. Finally, [**certain employees**] could be tested on their understanding of the MAs and their constraints on specific operations.

Finding no. 7: CSE has provided its employees with high-level learning opportunities to learn about its new authorities to conduct Active and Defensive Cyber Operations (ACO/DCOs). However, employees working directly on ACO/DCOs may not have the requisite understanding of the specifics of CSE’s new legal authorities and parameters surrounding their use.

Recommendation no. 7: CSE should provide a structured training program to its employees involved in the execution of Active and Defensive Cyber Operations (ACO/DCOs), to ensure that they have the requisite knowledge of CSE’s legal authorities, requirements, and prohibitions, as required by the associated Ministerial Authorizations.

Framework for CSE’s Engagement with GAC

Given the legislative requirement for the MFA to provide consent or to be consulted in relation to ACO/DCOs, NSIRA set out to assess whether CSE developed a framework for effective consultation and engagement of GAC officials in the intersection of their respective mandates.

GAC’s assessment of foreign policy risks

In GAC and CSE’s engagement during the development of the consultation framework, they developed a mechanism by which GAC is to consent or be consulted on an operation, and to provide its assessment of the operation’s foreign policy risk. In response to a consultation request by CSE, GAC is responsible for providing, within five business days, a Foreign Policy Risk Assessment (FPRA) that confirms whether [**redacted**]. Notably, the FPRA does not constitute an approval of an operation, only a consultation. In order to inform the development of the FRPA, CSE prepares a tailored [**document/mechanism**] for GAC which summarizes aspects of the operation. In our subsequent review, NSIRA will analyse whether the timeline provided to GAC for specific operations enabled it to meaningfully assess the associated foreign policy risks.

For GAC, several factors affect whether or not an ACO/DCO [**redacted**] These factors include whether an ACO/DCO aligns with GAC’s position on international norms in cyberspace and the furtherance of Canada’s national interests, [**relates to GC national security matters**] This is reflected in the TORs for the CSE-GAC WG, which require GAC to assess:

  • [**redacted**]
  • Compliance with international law and cyber norms;
  • Foreign Policy coherence, including whether the operation is in line with foreign policy, national security and defence priorities (i.e., beyond the [Standing Intelligence Requirements]); and
  • [**redacted**]

In the context of the above assessment requirements, GAC explained to NSIRA that it conducts a less detailed assessment of the foreign policy risk of specific operations, through the FPRA, on the basis that it has conducted a more detailed assessment of the classes of activities authorized in the MA.106 This assessment approach is reflected in [**redacted**] FPRAs received by NSIRA, which concluded that the operations fall within [**redacted**] but did not elaborate on the factors listed above. Given that the FPRA provides assurance of [**redacted**] of specific operations and is required under the ACO MA, NSIRA will closely review these assessments as part our subsequent review of operations.

Compliance with international law and cyber norms

[**redacted**]

Parliament may authorize violations of international law, but must do so expressly. An example of this is following the decision in X (Re), 2014 FCA 249, Parliament amended the CSIS Act through the adoption of Bill C-44 in 2015. The new provisions made it explicitly clear that CSIS could perform its duties and functions within or outside of Canada and that, pursuant to the newly adopted provisions of the CSIS Act, a judge may authorize activities outside Canada to enable the Service to investigate a threat to the security of Canada “without regard to any other law.” As per the language of the CSE Act, ACO/DCO MAs may only authorize CSE to carry out ACO/DCO activities “despite any other Act of Parliament or of any foreign state.” As outlined by case law, this language may not be sufficiently clear to allow the Minister to authorize violations of customary international law.

[**redacted**] the MAs reviewed by NSIRA stated that the activities “will conform to Canada’s obligations under international law” and each MA required that CSE’s “activities will not contravene Canada’s obligations under international law.” This would indicate that all activities conducted under this MA would be compliant with international law. However, the governance documents developed by CSE and GAC, such as the CSE-GAC consultation framework, do not set out parameters for assessing ACO/DCO activities for compliance with Canada’s obligations under international law, nor is it made clear against which specific international legal obligations ACO/DCO activities are to be assessed. NSIRA will closely monitor how CSE and GAC consider compliance with international law in relation to ACO/DCO activities in the subsequent review.

In NSIRA’s engagement with GAC, GAC highlighted its interdepartmental and international consultations dating back to 2016 on the Tallinn Manual 2.0 on the International Law Applicable to Cyber Operations (Tallinn Manual 2.0), which informed part of its development of the MAs [**redacted**]. GAC has created a Draft Desk book resulting from these consultations, which identifies Canada’s preliminary assessment of key rules of international law in cyberspace as described within the Tallinn Manual 2.0. NSIRA notes that while this analysis is a draft and does not represent Canada’s final position, it “has served as a starting point for further legal consideration.” NSIRA received no further documents that outline Canada’s understanding of how international law applies to ACO/DCO activities.

Further, documentation provided by both GAC and CSE recognizes a need to assess each potential ACO/DCO for lawfulness. GAC wrote that an analysis of the terms “acknowledged to be harmful” or “posing a threat to international peace and security” should be conducted within the context of each ACO/DCO. [**redacted**]

GAC explained that it assessed each activity within the authorized classes for compliance with international law at the MA development stage, and that consequently, a less detailed assessment of compliance with international law took place at the FPRA stage for each operation. GAC explained that the Draft Desk book and the Tallinn Manual 2.0 were consulted for these activities. From [**redacted**] FPRAs reviewed by NSIRA to date, it is not clear how the Draft Desk book or the analysis of the 2015 UN GGE voluntary norms has informed the assessment of each operation’s level of risk, or GAC’s conclusions that the ACO/DCOs complied with international law. Rather, GAC indicates that activities are compliant with international law, without an explanation of the basis behind these conclusions.

NSIRA notes that international law in cyberspace is a developing area, and recognizes that Canada and other States are continuing to develop and refine their legal analysis in this field. ACO/DCO activities conducted without a thorough and documented assessment of an operation’s compliance with international law would create significant legal risks for Canada if an operation violates international law. Ultimately, a better documented analysis of Canada’s legal obligations when conducting ACO/DCOs is necessary in order for GAC and CSE to assess an operation’s compliance with international law. NSIRA will further examine the lawfulness of ACO/DCO activities in our subsequent review.

Finding no. 8: CSE and GAC have not sufficiently developed a clear and objective framework with which to assess Canada’s obligations under international law in relation to Active and Defensive Cyber Operations.

Recommendation no. 8: CSE and GAC should provide an assessment of the international legal regime applicable to the conduct of Active and Defensive Cyber Operations. Additionally, CSE should require that GAC conduct and document a thorough legal assessment of each operation’s compliance with international law.

Bilateral communication of relevant information

Both GAC and CSE have implemented methodologies that require them to calculate risks based on certain factors. However, these types of risks are not absolute, and depend on a wide range of factors that can change over time or with the emergence of new information. In the case of GAC, those factors center around [**redacted**].

At present, CSE and GAC’s approach to accounting for any change in risks relies on GAC informing CSE if any change to Canada’s foreign policy should arise. However, based on GAC’s methodology above, the foreign policy risk of an operation may also rise if new information is uncovered about [**redacted**] or in relation to the potential impacts of the operation beyond a [**redacted**] For CSE’s part, it appears to primarily focus on changes to operational risks [**that are uncovered at a certain time or in a certain manner**]. This one-way mechanism does not account for other factors [**redacted**].

In this context, CSE has explained that an ACO/DCO is [**redacted**] and that as result, [**redacted**]. CSE further explained that DX and that subsequent activities may be adjusted as required using information obtained from the previous one. [**redacted**].

In this context, NSIRA observed operations that were planned to take place over a period of time, including a DCO where CSE would undertake [**related to CSE operations**]. Another ACO would see CSE [**redacted**]. In describing this operation to GAC, CSE wrote that activities would take place over a period of time [**redacted**].

[**related to CSE operations**] benefit from [**redacted**] of the ADO/DCOs [**redacted**]. NSIRA believes that a two-way notification mechanism triggering a re-assessment of the risks associated with an ACO/DCO should be established between CSE and GAC, whether those risks are uncovered prior to or during the course of an operation.

Finally, CSE’s internal governance process brings in GAC through [**a certain document/mechanism**]. In this context, GAC has highlighted objectives, [**redacted**] of an operation as information that CSE should provide for the purposes of assessing foreign policy risks. NSIRA has observed that the [**redacted**]. NSIRA notes that these details serve as important context to which GAC should have access as part of its assessment, particularly as GAC includes in its conclusions that the activities complied with [**redacted**].

Finding no. 9: CSE expects GAC to provide notification of any changes to foreign policy risks, but has not sufficiently considered the need to communicate other risks that may arise during an operation to GAC. Further, information critical to GAC’s assessment of foreign policy risks has also been excluded in materials CSE uses to engage GAC on an operation. As such, within the current consultation framework, CSE may not sufficiently communicate relevant information to GAC in support of its foreign policy assessment, and to manage ongoing changes in the risk associated with a cyber operation.

Recommendation no. 9: CSE and GAC should communicate to one another all relevant information and any new developments relevant to assessing risks associated with a cyber operation, both in the planning phases and during its execution.

Conclusion

This was NSIRA’s first review of CSE’s new powers to conduct ACO/DCOs, and it has illustrated CSE and GAC’s development of a governance structure for conducting these operations. CSE has now had the power to conduct these operations since 2019, though this review demonstrated that both departments begun conceptualizing a governance regime prior to the coming into force of the CSE Act. NSIRA is satisfied that CSE has, to date, developed a comprehensive governance structure, and commends its regular engagement with GAC to develop a consultation framework that sets out the roles and responsibilities of both departments.

However, at the broader governance level, CSE can improve the transparency and clarity around the planning of ACO/DCOs, particularly at this early stage, by setting out clearer parameters within the associated MAs for the classes of activities and target sets that could comprise ACO/DCOs. NSIRA further believes the continued development of cyber operations should benefit from consultation with other government departments responsible for Canada’s strategic priorities and objectives in the areas of national security and defence. Finally, CSE and GAC should develop a threshold and a definition for what constitutes a pre-emptive DCO, so as to ensure the appropriate involvement of GAC in an operation.

At the operational level, CSE and GAC should ensure that each operation’s compliance with international law is assessed and documented. On CSE’s part, it should ensure that information critical to assessing the risks of an operation be streamlined and included within all governance documents, and made available to all those involved in the development and approval of ACO/DCOs – including GAC. Finally, CSE should ensure that its operational staff are well-versed in the specifics of their new legislative framework and its applicability to specific operations.

While this review focused on the governance structures at play in relation to ACO/DCOs, of even greater importance is how these structures are implemented, and followed, in practice. We have made several observations about the information contained within the governance documents developed to date, and will subsequently assess how they are put into practice as part of our forthcoming review of ACO/DCOs.

Annex A: ACO/DCO Typologies

Figure 1: Different types of cyber operations. Source: CSE briefing materials

[**redacted figure**]

Figure 2: Difference between ACOs and DCOs. Source: CSE briefing material.

Figure 2: Difference between ACOs and DCOs. Source: CSE briefing material.
DEFENSIVE CYBER OPERATIONS ACTIVE CYBER OPERATIONS
Authorized Activites
  • Gaining acess to a portion of the global information infrastructure
  • Installing, maintaining, copying, distributing, searching, modifying, disruption, deleting or intercepting anything on or through the global information infrastructure
  • Doing anything that is reasonably necessary to maintain the covert nature of the activity
  • Carrying out any other activity that is reasobably in the circumstances and reasonably necessary in the aid of any other activity, or class of activities, authorized by the Ministerial Authorization
Ministerial Approval MND approval with MFA consultation MND approval with the consent or request of MFA
Intent To take action online to protect electronic information and infrastructures of importance to the government of Canada To degrade, disrupt, influence, respond to or interfere with capabilities of foreign individual, state, organization
Context Initiated in response to a cyber threat, or proactively to prevent a cyber threat Initiated in accordance with Ministerial direction as it relates to international affairs defence or security.
Threat Actor/Target Set Conducted against threats linked to Government systems and systems of importance, irrespective of the actor
**Once confirmed not against a Canadian, person in Canada, or on GII in Canada
Conducted against specific targets in acordance with the Ministerial Authorization
**Once confirmed not against a Canadian, person in Canada, or on GII in Canada
Outcome Conducted with a view to stop or prevent cyber threats in a manner that is reasonable and proportionate to the intrusion or threat Conducted to the extent directed by the Ministerial Authorization and that is reasonable and proportionate

Annex B: ACO/DCOs (2019-2020)

[**redacted**]

Annex C: CSE-GAC Framework

Interdepartmental Group CSE-GAC Senior Management Team (SMT) DG CSE-GAC ACO/DCO Working Group ADM-Level
Co-Chairs SMT Co-Chairs: CSE DG, [**redacted**], GAC, DG Intelligence Bureau Co-Chairs: CSE, DG [**redacted**] GAC,DG Intelligence Bureau. It iscomposed of some of the same DG-Level participants as the SMT as well as their working-level supports. Co-Chairs: CSE, Deputy Chief, SIGINT GAC, ADM (Political Director) International Security
Roles and Responsibilities

Exchanges information on the departments’ respective plans and priorities, as well as areas of collaboration.
Under the auspices of the SMT, this entity was established with a mandate to collaborate specifically on ACO/DCO matters.
Implementation of the governance framework associated with current and planned [**redacted**]. Coordinates information sharing related to the operational planning and execution of ACO/DCOs, as well as their associated risks and adherence to Canada’s foreign policy Collaborates on the renewal, evolution, and development of current and future MAs
Resolves any issues under the purview of the WG that cannot reach resolution at the DG-level.

Annex D: Findings and Recommendations

Findings

Finding no. 1: The Active and Defensive Cyber Operations Ministerial Authorization Applications do not provide sufficient detail for the Minister(s) to appreciate the scope of the classes of activities being requested in the authorization. Similarly, the Ministerial Authorization does not sufficiently delineate precise classes of activities, associated techniques, and intended target sets to be employed in the conduct of operations.

Finding no. 2: The assessment of the foreign policy risks required by two conditions within the Active and Defensive Cyber Operations Ministerial Authorizations relies too much on technical attribution risks rather than characteristics that reflect Government of Canada’s foreign policy.

Finding no. 3: The current governance framework does not include a mechanism to confirm an Active Cyber Operation’s (ACO) alignment with broader Government of Canada (GC) strategic priorities as required by the CSE Act and the Ministerial Authorization. While these objectives and priorities that are outside CSE and GAC’s remit alone, the two departments govern ACOs without input from the broader GC community involved in managing Canada’s overarching objectives.

Finding no. 4: CSE and GAC have not established a threshold to determine how to identify and differentiate between a pre-emptive Defensive Cyber Operation and an Active Cyber Operation, which can lead to the insufficient involvement of GAC if the operation is misclassified as defensive.

Finding no. 5: CSE’s internal policies regarding the collection of information in the conduct of cyber operations are not accurately described within the Active and Defensive Cyber Operations Ministerial Authorizations.

Finding no. 6: The [**redacted**] process, which occurs after planning documents have been approved, contains information that is pertinent to CSE’s broader operational plans. The [**redacted**] at times contained pertinent information absent from these other documents, even though it is approved at a lower level of management.

Finding no. 7: CSE has provided its employees with high-level learning opportunities to learn about its new authorities to conduct Active and Defensive Cyber Operations (ACO/DCOs). However, employees working directly on ACO/DCOs may not have the requisite understanding of the specifics of CSE’s new legal authorities and parameters surrounding their use.

Finding no. 8: CSE and GAC have not sufficiently developed a clear and objective framework with which to assess Canada’s obligations under international law in relation to Active and Defensive Cyber Operations.

Finding no. 9: CSE expects GAC to provide notification of any changes to foreign policy risks, but has not sufficiently considered the need to communicate other risks that may arise during an operation to GAC. Further, information critical to GAC’s assessment of foreign policy risks has also been excluded in materials CSE uses to engage GAC on an operation. As such, within the current consultation framework, CSE may not sufficiently communicate relevant information to GAC in support of its foreign policy assessment, and to manage ongoing changes in the risk associated with a cyber operation.

Recommendations

Recommendation no. 1: CSE should more precisely define the classes of activities, associated techniques, and intended target sets to be undertaken for Active and Defensive Cyber Operations as well as their underlying rationale and objectives, both in its Applications and associated Ministerial Authorizations for these activities.

Recommendation no. 2: GAC should include a mechanism to assess all relevant foreign policy risk parameters of Active and Defensive Cyber Operations within the associated Ministerial Authorizations.

Recommendation no. 3: CSE and GAC should establish a framework to consult key stakeholders, such as the National Security and Intelligence Advisor to the Prime Minister and other federal departments whose mandates intersect with proposed Active Cyber Operations, to ensure that they align with broader Government of Canada strategic priorities and that the requirements of the CSE Act are satisfied.

Recommendation no. 4: CSE and GAC should develop a threshold that discerns between an Active Cyber Operation and a pre-emptive Defensive Cyber Operation, and this threshold should be described to the Minister of National Defence within the applicable Ministerial Authorizations.

Recommendation no. 5: In its applications to the Minister of National Defence, CSE should accurately describe the potential for collection activities to occur under separate authorizations while engaging in Active and Defensive Cyber Operations.

Recommendation no. 6: CSE should include all pertinent information, including targeting and contextual information, within all operational plans in place for a cyber operation, and in materials it presents to GAC.

Recommendation no. 7: CSE should provide a structured training program to its employees involved in the execution of Active and Defensive Cyber Operations (ACO/DCOs), to ensure that they have the requisite knowledge of CSE’s legal authorities, requirements, and prohibitions, as required by the associated Ministerial Authorizations.

Recommendation no. 8: CSE and GAC should provide an assessment of the international legal regime applicable to the conduct of Active and Defensive Cyber Operations. Additionally, CSE should require that GAC conduct and document a thorough legal assessment of each operation’s compliance with international law.

Recommendation no. 9: CSE and GAC should communicate to one another all relevant information and any new developments relevant to assessing risks associated with a cyber operation, both in the planning phases and during its execution.

Share this page
Date Modified:

NSIRA Review of CSIS Dataset Regime

Date of Publishing:

List of Acronyms

ACRONYM Description
CSIS Canadian Security Intelligence Service
DAG Data Acquisition and Governance
DDO Deputy Director of Operations
DMEX Data Management and Exploitation
ERC External Review and Compliance
FC Federal Court
IC Intelligence Commissioner
JA Judicial Authorization
NSA 2017 National Security Act 2017
NSIRA National Security and Intelligence Review Agency
ODAC Operational Data Analysis Center
PAD Publicly Available Dataset
PCO Privy Council Office
PS Public Safety Canada
SIRC Security Intelligence Review Committee

Glossary of Terms

Approved classes of Canadian datasets. Categories of Canadian datasets approved by the Minister and authorized by the Intelligence Commissioner. The Canadian Security Intelligence Service can only collect and retain a Canadian dataset if it falls under an approved class.

Canadian dataset. A dataset that predominantly relates to individuals within Canada or Canadians.

Dataset. A collection of information stored as an electronic record and characterized by a common subject matter.

Designated employee. An employee designated by the Minister who can carry out one or more activities referred to in sections 11.07 and 11.22, such as evaluating, querying, and exploiting section 11.05 datasets.

Dataset regime. Sections 11.01 to 11.25, 27.1 of the Canadian Security Intelligence Service Act governing datasets.

Evaluation. The period in which designated employees shall, as soon as feasible but no later than the 90th day after the day on which the dataset was collected, evaluate the dataset and confirm if it:

  • Was publicly available at the time of collection;
  • Predominantly relates to individuals within Canada or Canadians and whether it belongs to an approved class; or
  • Predominantly relates to individuals who are not Canadians and who are outside Canada or corporations that were not incorporated or continued under the laws of Canada and whoa re outside Canada

Exigent circumstances. A situation in which there is a danger to the life or safety of an individual or a situation requiring the acquisition of intelligence of significant importance to national security, the value of which would be diminished or lost if the Canadian Security Intelligence Service is required to comply with the authorization process under section 11.13 or sections 11.17 and 11.18.

Exploitation. A computational analysis of one or more datasets for obtaining intelligence that would not otherwise be apparent.

Foreign dataset. A dataset that predominantly relates to individuals who are not Canadians and who are outside Canada or corporations that were not incorporated or continued under the laws of Canada and who are outside Canada.

Judicial Authorization. The process by which a Federal Court judge authorizes the retention of a Canadian dataset.

Minister. In this report, Minister refers to the Minister of Public Safety.

Publicly available dataset. A dataset that was publicly available at the time of collection.

Query. A specific search, with respect to a person or entity, of one or more datasets, for obtaining intelligence.

Section 12 investigations. Investigations carried out by the Canadian Security Intelligence Service that relates to threats to the security of Canada.

Threat to the security of Canada. Activities within or that relate to Canada that involve the following:

  • Espionage or sabotage;
  • Foreign influenced activities;
  • The threat or use of acts of serious violence against persons or property for achieving a political, religious, or ideological objective; and
  • Activities directed toward undermining by covert unlawful acts, or directed toward or intended ultimately to lead to the destruction or overthrow by violence of, the constitutionally established system of government in Canada.

Executive Summary

The Government of Canada introduced the dataset regime through the National Security Act 2017 (NSA 2017) as a modification to the CSIS Act in July 2019. This regime, constituting sections 11.01-11.25 of the Canadian Security Intelligence Service Act (CSIS Act, hereafter the Act), enables CSIS to collect and retain datasets containing personal information that are not directly and immediately related to activities that constitute a threat to the security of Canada, but are likely to assist in national security investigations.

This review has four sections. The first section, the governance section, describes how CSIS has implemented the regime, CSIS’s first judicial authorization for a Canadian dataset, legislative gaps in the Act, and the department’s internal policies governing the regime. The second section of this review concerns CSIS’s dataset information management and retention practices. The third section concerns how CSIS trains its employees on their dataset regime-related duties and obligations as well as resourcing challenges. Finally, this review includes a case study that encompasses the issues and obstacles related to all of the above-mentioned sections.

In terms of governance and implementation, the National Security and Intelligence Review Agency (NSIRA) found that CSIS’s current application of the dataset regime is inconsistent with the statutory framework. CSIS’s current approach to dataset information collection under section 12 risks the creation of a parallel collection mechanism, one that weakens s.12’s statutory thresholds and simultaneously lacks the external oversight regime intended to protect personal information under the dataset regime.

In 2021, CSIS sought judicial authorization to retain the first Canadian dataset, but in a manner that leads NSIRA to doubt the Federal Court was fully apprised of the internal contradicting views concerning the datasets use prior to the invocation of the dataset regime. Moreover, pending the judicial authorization, CSIS conducted queries pursuant to the exigent circumstances authorization, and retained partial name matches. NSIRA found that the results retained thereof did not meet the strictly necessary threshold applicable for the retention of this information pursuant to section 12 of the Act. NSIRA recommends that CSIS immediately destroy any record containing the names retained pursuant to the exigent circumstances queries, as they do not meet the “strictly necessary” threshold.

This review highlights a gap in the CSIS Act that presents issues as to the governance of foreign datasets. NSIRA notes that the current Act does not provide a time limitation for the Minister, or the Minister’s designate, to authorize the retention of a foreign dataset. Prior to the dataset regime, CSIS collected bulk data that would no longer be compliant pursuant to the new regime. After the dataset regime came into force, CSIS submitted on October 11, 2019, several foreign datasets to the Director, acting as the Minister’s designate. The Intelligence Commissioner (IC) approved the first foreign dataset from this bulk data on December 16, 2020. As of December 2022, CSIS had only submitted two more requests for approval to the IC, totalling three approvals in three years. NSIRA notes that the legislative gap allows the authorization request to remain before the Director, un-actioned for years, and puts into question how CSIS will meet the “likely to assist” threshold and utility of these datasets. NSIRA recommends adding a time limitation for the authorization of a foreign dataset by the Minister or the Minister’s designate.

The final piece on the governance section of this review focuses on the policies CSIS adopted for the dataset regime. NSIRA found that CSIS policies governing publicly available datasets do not contain a requirement for a reasonable expectation of privacy analysis of the collected information. This issue is especially pertinent when considering the strong emerging market for data purchased through data brokers and risks associated with purchasing commercially available information that collectors may have unlawfully collected. NSIRA recommends that CSIS meaningfully analyze and document any possible reasonable expectation of privacy when evaluating publicly available datasets. NSIRA also found that CSIS does not have a policy governing transitory information and that the existing internal directive does not provide employees with sufficient instruction which may result in CSIS retaining information that would otherwise be subject to the dataset regime.

This review’s second section concerns information management and retention of section 11 datasets. From 2018-2019, CSIS conducted an inventory of its holdings to identify information that would be subject to the dataset regime once it came into force. In early 2022, CSIS identified multiple incidents of data, operational reports, and Canadian information extracted from foreign datasets that should have been destroyed. Having identified the non-compliance, CSIS proceeded to implement remedial actions to ensure that any such data is identified and destroyed. In October 2022, NSIRA conducted a search in CSIS’s corporate system and found files containing tens of thousands of entries of Canadian personal information extracted from foreign datasets as well as information amounting to foreign datasets. NSIRA was not provided a satisfactory explanation as to why this information continues to be retained in CSIS’s corporate system or how CSIS distinguishes this information from what it had previously identified as a non-compliance. NSIRA finds that, as of August 2023, CSIS did not comply with the dataset provisions in the CSIS Act because it retained Canadian information extracted from foreign datasets, and foreign information amounting to a dataset.

Moreover, NSIRA did another search in CSIS’s operational repository and found information that would amount to a Canadian dataset. CSIS had not sequestered the operational report, rendering it accessible to all who use the system, contrary to the dataset regime’s retention obligations. NSIRA informed CSIS of this report and was informed it would be treated as a compliance incident. NSIRA again conducted a second search and found another report containing information that would otherwise amount to a Canadian dataset. NSIRA finds that CSIS did not comply with the dataset provisions of the CSIS Act because it retained Canadian information and referenced it as recently as 2022. NSIRA recommends that CSIS immediately destroy Canadian and foreign information found in its corporate and operational repositories that is not strictly necessary to retain. This non-compliant information no longer falls within the legal 90-day evaluation period and retaining it pursuant to the dataset regime is no longer a possibility. NSIRA recommends that CSIS cease to create duplicates of information reported in the operational system and conduct an exhaustive scan of its operational and corporate repositories to identify any non- compliant information.

This review’s third section focuses on training and resourcing. Prior to the coming into force of the dataset regime, CSIS developed and implemented training for the designation of employees pursuant to the dataset regime and mandatory training for all operational employees. NSIRA finds that the training required to become a designated employee to evaluate, query, and exploit section 11 datasets offers clear information on collection and retention requirements. However, NSIRA finds that CSIS operational personnel, including those predominantly dealing with bulk information collection, have not received adequate training allowing them to identify when collected information may fall within the dataset regime. The training is offered on a once-and-done basis for operational employees and contradicts CSIS’s current application of the regime. NSIRA recommends that CSIS develop and deliver scenario-based workshops to train operational personnel on CSIS’s current application of the dataset regime so that they can engage subject matter experts as necessary.

Encompassing all the above-mentioned issues, NSIRA identified a case study that illustrates the challenges CSIS faces in its implementation of the dataset regime. The case involved a dataset containing information regarding thousands of Canadians. NSIRA finds CSIS collected information in relation to activities that could not on reasonable grounds be suspected to have constituted a threat to the security of Canada and the collection, analysis and retention of which was not strictly necessary. The Department of Justice and CSIS managers did not present CSIS executives the totality of information regarding the dataset at the point of collection. The information was also collected absent an analysis of the Charter and privacy considerations. NSIRA recommends that CSIS immediately destroy the case study dataset it collected pursuant to section 12. This information no longer falls within the legal 90-day evaluation period and retaining it pursuant to the dataset regime is no longer a possibility.

The review concludes that CSIS has failed to adequately operationalize the dataset regime. CSIS did not seek to clarify legal ambiguities [**redacted**] of the application of the regime before the Court when given the opportunity to do so. Rather, CSIS has adopted multiple positions on the application of the dataset regime, and now risk limiting what is a collection and retention regime to a retention mechanism. Internally, CSIS has not provided sufficient resources and training to ensure compliance with the regime. Absent an internal commitment to adequately operationalize, resource and support the implementation of a new legal regime, any such regime will fail no matter how fit for purpose it is perceived.

Introduction

Authority

The National Security Intelligence Review Agency (NSIRA) conducted this review pursuant to 8(1)(a) of the National Security Intelligence Review Agency Act.

Scope of the review

NSIRA reviewed the Canadian Security Intelligence Service’s (CSIS, or the Service) implementation of the dataset regime between January, 2019 and June 30, 2022. As the review progressed, NSIRA found it necessary to also consider pertinent information outside of this scope.

Methodology

NSIRA conducted document reviews, interviews, and received briefings. NSIRA also received onsite demonstrations of systems by CSIS subject matter experts. Direct access to these systems was also granted to NSIRA.

Review statements

NSIRA was able to verify the information it received during the review in a manner that met its internal expectations and requirements. NSIRA had direct access to CSIS systems and repositories, and therefore was able to corroborate information.

With respect to responsiveness, while there were minor instances where CSIS did not provide the totality of the information to NSIRA, overall CSIS met NSIRA’s expectations for responsiveness.

Background

In 2015, the Security Intelligence Review Committee (SIRC), NSIRA’s predecessor, reviewed the collection and retention of information related to CSIS’s Data Acquisition Program. The review examined CSIS’s bulk datasets regime and noted that “SIRC has seen no evidence to suggest that CSIS has systematically taken the CSIS Act s 12 statutory threshold of ‘strictly necessary’ into consideration; CSIS’s lack of process, governance and legal guidance around the acquisition and management of bulk data is lacking and non consistent with the practice of close allies.”

Following the publication of SIRC’s annual report, the Federal Court (hereafter the Court) considered data retention issues in the 2016 “Associated Data” decision. The Court found that CSIS had exceeded the limitations of its legislative mandate by retaining information contrary to the “strictly necessary” limitations prescribed by section 12(1) of the Canadian Security Intelligence Service Act (CSIS Act). Under the “strictly necessary” statutory requirement as applicable to the facts in that judgment, CSIS cannot retain information that is not directly threat-related to the security of Canada unless such information can be related to a warranted target. The Court concluded that CSIS was acting unlawfully when retaining non-threat-related information under the “strictly necessary” qualifier past the warranted time limits.

The Government of Canada introduced the dataset regime through the National Security Act 2017 (NSA 2017) as a modification to the CSIS Act in July 2019. This regime authorizes CSIS to collect datasets that are likely to assist it in its duties and functions; that is, datasets that do not meet the “strictly necessary” otherwise required by s 12.

NSIRA’s review of the dataset regime is the first since the NSA 2017 came into force. This review examines and scrutinizes the governance and operationalization of the regime. In looking at the implementation of the regime, NSIRA also reviews the systems and processes in place for the ingestion, evaluation, query, and exploitation of datasets, a detailed description of which is provided in the Technical Annex A of this report.

Summary of the dataset regime in legislation

The CSIS Act’s (hereafter the Act) provisions governing the regime are found at sections 11.01 to 11.25, 21, 27 & 27.1 of the Act (henceforth referred to as the dataset regime). The Act defines a dataset as a “collection of information stored as an electronic record and characterized by a common subject matter.” The application clause at section 11.02 states that: “Sections 11.01 to 11.25 apply to every dataset that contains personal information, as defined in section 3 of the Privacy Act, that does not directly and immediately relate to activities that represent a threat to the security of Canada.”

The level of authorizations and approvals for collection and retention of a dataset are proportionate with the level of privacy intrusion. For all categories of datasets, publicly available, Canadian, and foreign, CSIS may: “collect the dataset if it is satisfied that the dataset is relevant to the performance of its duties and functions under sections 12 to 16.” An additional, higher threshold exists for the retention of foreign and Canadian datasets where CSIS must establish that the collected dataset is “likely to assist” in the performance of its duties or functions.

The legal framework for the publicly available datasets (PADs), the foreign dataset and Canadian datasets is summarized in the table below:

                                                                                                   
  Publicly Available Foreign Canadian
Definition A dataset that was publicly available at the time of collection. A dataset that predominately relates to individuals who are not Canadians and who are outside Canada or corporations that were not incorporated or continued under the law of Canada who are outside Canada. A dataset that predominately relates to individuals within Canada or Canadians.
Collection Threshold: Relevant to the performance of duties and functions under s. 12 to s.16
    Must belong to an approved class authorized by the Minister and approved by the Intelligence Commissioner (IC)
Evaluation Within 90 days of the day on which it was collected (no query or exploitation): Designated employee shall delete any personal information that is not relevant to CSIS’s performance of its duties and functions. Designated employee may delete extraneous/erroneous/poor quality information; conduct translation and/or decryption, apply privacy protection techniques; any activity to organize the dataset.
  Designated employee shall delete any information where there is reasonable expectation of privacy that relates to physical or mental health.
  Designated employee to remove any information that relates to a Canadian or person in Canada. Designated employee to delete any information that is subject to solicitor client privilege.
Retention May retain for purposes of s. 12 to s.16. Threshold: Must be likely to assist in the performance of duties and functions.
Minister or Ministers designate authorize, followed by approval by the IC. Minister approval followed by application for judicial authorization.
Retention periodNo limitations (internal retention policy) Maximum 5 years (can reapply)Maximum 2 years (can reapply)
Query/ExploitMay query, exploit, and retain results for s. 12 to 16.Designated employee may query or exploit (and retain results) to extent that is strictly necessary for s. 12, 12.1, and as required under s. 16.
May query and exploit (and retain results) for s. 15.
Record KeepingRecord: – rationale for collection; – details of every exploitation; and – details of statutory authority under which query/exploit information is retained. Conduct random and periodic verification
Must: – Store and manage separately from other information; and – Limit access to designated employees and ensure that information is communicated only for performing duties under the act.
Exigent CircumstancesDirector may authorize (subject to IC approval) the query of a dataset that has not been authorized if there are exigent circumstances that require the query to preserve life of safety of an individual or to acquire intelligence of significant importance to national security the value of which would be diminished or lost if CSIS were too comply with the authorization process.
ReportingReport to NSIRA: – Any verification done as required by record keeping provisions. – Removal of information from a foreign dataset that concerns Canadians or persons in Canada. – Copy of the Director’s authorization for exigent circumstances query, the results of the query, and the actions taken after obtaining the results of the query. *NSIRA may report to the Director if it is of the view that query/exploitation of the dataset did not comply with the law. Director to send report along with any additional information to the Federal Court. Federal Court may issue a direction or order or take any other measure considered appropriate

Governance

CSIS’s interpretation and application of the dataset regime

Finding 1: NSIRA finds that CSIS’s current application of the dataset regime is inconsistent with the statutory framework.

Finding 2: NSIRA finds that CSIS’s current approach to dataset information collection under section 12 risks the creation of a parallel collection mechanism, one that weakens section 12’s statutory thresholds and at the same time lacks the external oversight regime intended to protect personal information under the dataset regime.

The dataset regime sought to create a method of allowing the collection and retention of certain information that would not be possible pursuant to section 12 of the CSIS Act. CSIS was actively involved in advocating for this detailed regime and noted during the senate hearings that it (sections 11.01-11.24) was “quite a complex piece of legislation” which required that they work closely with the Department of Justice (hereafter Justice) to examine the “various processes that [they] could employ to make sure” that it was a very “charter compliant regime.” Having been so involved with the drafting of the regime, CSIS was thus well positioned to develop policies and procedures governing the collection, evaluation, query, exploitation and verification of datasets. At issue for CSIS was whether the dataset regime limits collection authorities of datasets under CSIS’s information collection mandates in section 12 (security intelligence), section 15 (security screening investigations), or section 16 (foreign intelligence). CSIS initially adopted the position that, in cases where the dataset was not directly and immediately related to threat activities, it had to be ingested under the section 11.01 regime (hereafter, CSIS’s initial position). This position did not affect the ability to collect information that directly and immediately related to threat activities under section 12.

[**redacted**] CSIS shifted its position to consider the dataset regime as, in effect, subordinate to the collection authorities in sections 12, 15, or 16 of the CSIS Act. In practice, CSIS relies on the dataset regime if and when it has determined that the information falls outside these collection authorities (hereafter, CSIS’s current position). This position reflects an evolution in understanding about the dataset regime’s scope.

CSIS’s application of the dataset regime as reflected in their policies, presentations, and NSA 2017 training materials more closely conformed to their initial position. However, by April 2022, CSIS adopted its current position on the application of the dataset regime, concluding also that the Court supported this interpretation. CSIS now regards the dataset regime as allowing the collection and use (searches) of datasets pursuant to section 12, followed by their retention pursuant to the dataset regime. CSIS has continued to evolve its current position to allow for broader collection and retention under section 12.

Notably, section 12 includes conditions on collection (and retention) that are more demanding than the equivalent thresholds for collection and retention under the dataset regime. Under section 12, an investigation depends on a reasonable grounds to suspect a threat to the security of Canada, and information collection and retention only to the extent “strictly necessary.” The dataset regime, for its part, permits collection where CSIS is “satisfied that the dataset is relevant to the performance of its duties and functions” under sections 12 to 16. Retention of foreign and Canadian datasets is permitted on the threshold of “likely to assist” the enumerated CSIS mandates. Section 12 and the dataset regime also differ in terms of control regimes. CSIS retains under section 12 without any external oversight. Retention under the dataset regime of Canadian datasets requires the Court’s authorization, retention of foreign datasets requires the IC’s approval.

The dataset regime was created for the purpose of broadening carefully-regulated dataset collection and retention in circumstances where the section 12 “strictly necessary” threshold could not be met. NSIRA noted, however, that in the period since the evolution of CSIS’s current position, discussed above, CSIS’s operationalization of the dataset regime and their understanding of the application of the regime seems to have significantly broadened the scope of information captured under its section 12 authorities. This evolution is discussed in the case study at the end of this report.

The [**redacted**] formerly the Data Management and Exploitation or DMEX) is a branch whose primary function is the governance of the dataset regime. By June 2023, CSIS informed NSIRA that [**redacted**] would now move to fully prioritize s. 12 collection over dataset regime collection. CSIS stated that absent a less prescriptive legislative framework for dataset collection, CSIS would not be collecting datasets unless the intention was to exploit them. CSIS then presented NSIRA with a clear example of a foreign dataset within the meaning of the dataset regime and indicated that since there was a possibility that there may be hostile actors on the list, it could be collected pursuant either to section 11.05 of the dataset regime or collected pursuant to s. 12. It could also be searched under section 12, with any threat related search results retained under section 12 and the remainder of the list destroyed.

Two concerns stem from CSIS’s evolving approach to datasets illustrated by the case studies that follow. First, the ingestion of datasets under section 12 may now, in practice, reflect a broadened understanding of the section 12 “reasonable grounds to suspect” and “strictly necessary” thresholds. The standards now invoked to justify the collection and retention of some datasets putatively under section 12, are closer to the “satisfied” and “likely to assist” thresholds for the dataset regime. NSIRA acknowledges that some information meeting the definition of a dataset, i.e. the collection of information stored as an electronic record and characterized by a common subject matter, may fall within section 12 collection and use authorities, e.g. a list of Canadian Extremist Travelers. However, NSIRA’s concerns relate to when s. 12 authorities are interpreted to allow for the collection and use of personal information that is not directly and immediately related to activities that represent a threat to the security of Canada. This approach is inconsistent with the statutory framework and risks the creation of a parallel collection mechanism, one that weakens section 12’s statutory thresholds and at the same time lacks the external oversight regime intended to protect personal information under the dataset regime.

Second, a multi-stage vetting process necessarily follows from an interpretation of the CSIS Act in which the dataset regime applies only where datasets (meeting the section 11.02 definition) cannot be collected or retained under the section 12, 15, or 16 mandates. Not least, there will be a preliminary phase in which CSIS will need to decide which authority applies and whether (because no other collection or retention authority is available) the dataset must be processed under the dataset regime. Without careful guidance, there is a considerable risk of confusion as to what may be done with the dataset during this triage vetting, especially since that vetting process is not expressly anticipated by the Act. It is not clear that the Act accommodates a parallel and separate process in which a dataset is collected under section 12, searched for intelligence purposes, and only then transferred for retention under the dataset regime. This would seem to render the exigent search powers in s 11.22 redundant. While NSIRA was not able to fully confirm the sequence of events, the Canadian dataset judicial authorization case study discussed in the next section reflects the risk of confusion.

Canadian Dataset Judicial Authorization

Finding 3: NSIRA finds that CSIS failed to fully apprise the Court on their interpretation and application of the dataset regime. CSIS should have sought clarification from the Court as to its views on the precise conduct permissible prior to invocating the dataset regime.

Finding 4: NSIRA finds that when conducting queries in exigent circumstances, CSIS retained information that did not meet the section 12 strictly necessary threshold.

From [**redacted**], CSIS collected [**redacted**] individuals [**redacted**] contained personal information of [**redacted**]. The datasets were provided to CSIS from multiple government [**redacted**] departments [**redacted**]. These datasets were [**redacted**] received by the [**redacted**] Unit and therefore [**redacted**] deemed collected pursuant to s. 12. However, CSIS then sought to retain the pursuant to the dataset regime, requiring authorization by the Federal Court (FC). The result was the first judicial authorization decision under the dataset regime. There are two concerns about the management of this dataset.

Initial consideration of the dataset under section 12

In the lead-up to this authorization, there appears to have been considerable uncertainty as to how this dataset might be used. The evidence shows that [**redacted**] received the [**redacted**] through the Security of Canada Information Disclosure Act. [**redacted**] considers all information disclosed and collected by their branch as section 12 information. Upon receipt of the dataset, [**redacted**] was not aware of the discussions occurring within other branches regarding the possibility of applying to the Court for the retention of [**redacted**] through judicial authorization. [**redacted**] treated the information much like any other section 12 information and searched at least two of the names [**redacted**] within CSIS’s operational database, [**redacted**], one of which yielded results.

NSIRA was initially informed that these searches did not amount to queries because they were not searches within the [**redacted**], rather they were searches of names from the [**redacted**] against [**redacted**]. NSIRA was also informed that the searches were not queries because they were not for “the purposes of obtaining intelligence” as defined in the Act, since the results of the searches were not reported [**redacted**]. In [**redacted**] discussion with CSIS, NSIRA received conflicting information that demonstrated internal contradictions and confusion on these points.

In the cover letter to the affidavit for judicial authorization (JA) for a Canadian dataset filed with the Court, Counsel notes that “the Service’s initial collection and use of this information as described in the affidavit falls with the scope of the service’s [**redacted**]. In the affidavit, CSIS stated that “… [**redacted**] verified whether this collection of information was already within Service holdings and assessed the potential intelligence value for its investigations. No searches were conducted for intelligence purposes…” In a previous draft of the affidavit, the chief of DMEX had expressed their concern regarding this wording of the draft affidavit.

They noted that “We have already clearly stated that the datasets were initially collected [**redacted**] authorities. We can also say that checks were done under those authorities but immediately ordered stopped once s.11 was invoked (which happened quickly).” NSIRA could not determine if searches of names from the list against CSIS’s operational system were conducted with the objective of “verifying” whether the “collection of information was already with Service holdings.” In examining this issue, it became apparent that there were multiple opinions and conflicting narratives regarding what actions were taken upon receipt of the dataset and what CSIS perceives as permissible when dataset information is collected through s. 12.

The Federal Court found in its authorization decision that it was reasonable to collect the dataset pursuant to s. 12, in the circumstances of this matter. The Court notes that “the decision was taken to invoke the dataset regime and to request approval to query the information under the exigent circumstances provision in s. 11.22 of the Act.” It is unclear if the Court knew the full record of uncertainty about what could be done with the dataset in the interim between collection under section 12 and the commencement of the dataset regime retention process. CSIS should have fully apprised the Court of this uncertainty (including the conflicting narratives regarding how the data was and may be used) and sought clarification from the Court as to its views on the precise conduct permissible prior to the invocation of the dataset regime.

This is especially the case since, both in the decision and during the hearings for the JA, the Court expressed its concern that the classes authorized by the Minister and approved by the IC were too broad. The Court added that “just about anything under the sun could be captured by one of those classes.” Yet, CSIS assured the Court more than once that information collected was pursuant to s. 11.05 and was protected by the safeguards of the regime, that the information had high access control and could not be queried or exploited. Accordingly, the Court was informed that while the classes are broad, the regime provides the necessary safeguards to protect the privacy of Canadians. This response deemphasized the degree to which information from the dataset might be used during the triage period. Again, this discussion presented CSIS with the opportunity to judicially test its application of the interpretation of the dataset regime before the Court. CSIS could have informed the Court that these safeguards may not necessarily be in place where information is collected pursuant to section 12 prior to a pivot to the dataset regime as the retention authority. It appears that CSIS chose to carry this legal uncertainty at the risk of receiving a constraining interpretation of the regime by the Court.

Querying and retention under exigent circumstances

Notably, once CSIS initiated the dataset regime process, the dataset for which the JA was sought was the subject of an authorization and approval pursuant to s. 11.22 exigent circumstances. CSIS sought and received authorization from the Director and approval from the IC to query the datasets. As per the requirements of section 11.13(2) of the Act, CSIS included in its application for JA the contents of the exigent circumstances authorization, the results of the authorized query, and any actions taken after obtaining these results. This information was also provided to NSIRA as required by s. 11.25(c) of the Act.

CSIS queried the names [**redacted**] CSIS retained [**redacted**] partial matches and reported them in their section 12 operational system. In examining the queries conducted, NSIRA found that the initial searches were extremely broad with many name [**redacted**] searched using extensive use of [**redacted**], and a very large margin for date of birth [**redacted**].

These broad queries resulted in numerous “hits” against the list. For example, [**redacted**] were all considered by the CSIS analyst as appropriate search results against [**redacted**]. These names were then searched in [**redacted**]. Information from an exigent query may be retained if “carried out under section 12”, imposing that section’s “strictly necessary” threshold. Despite there being no results for any of full [**redacted**] names in [**redacted**], CSIS determined that the absence of the names in its operational system meant that the names could not be eliminated as “a possible candidate for identification” and that “ultimately, those possible matches that cannot be excluded will be reported to the desk and retained under s. 12 for further investigation.”28 Similarly, should the name of [**redacted**] be too common to rule out, CSIS retained that name as strictly necessary.

The results of these unnecessarily broad queries did not meet the strictly necessary threshold for retention. [**redacted**] In March 2022, CSIS reported that [**redacted**] has determined it would not pursue investigative steps regarding the results (reported in [**redacted**]) absent additional information” and that the [**redacted**] results retained were “captured in their entirety for retention in the event that the dataset is destroyed.” The exigent circumstances queries cannot be used to circumvent the retention obligations that would apply under s.12 or as means to retain information pending the outcome of the judicial authorization.

Recommendation 1: NSIRA recommends that in the next judicial authorization application for a Canadian dataset CSIS put its current position on the application of the dataset regime before the Court, including any use of the information prior to the decision to retain under the dataset regime.

Recommendation 2: NSIRA recommends that CSIS immediately destroy any record containing names retained pursuant to the exigent circumstances queries as they do not meet the strictly necessary threshold.

Gap in the legislation

Finding 5: NSIRA finds that the lack of explicit time limits in section 11.17 of the dataset provisions governing foreign datasets has resulted in datasets being retained for multiple years pending a decision by the Minister or the Minister’s designate (the CSIS Director).

The dataset regime added many detailed provisions to the CSIS Act. Despite the complexity of the regime, NSIRA noted gaps in the legislation. The provisions of the Act governing the authorization of the retention of foreign datasets do not provide a time limitation for the Minister or the Minister’s designate to authorize the retention of a foreign dataset. Prior to the coming into force of the dataset regime, CSIS had accumulated bulk data that would no longer be compliant pursuant to the new regime. Accordingly, the transitional provisions of Bill C-59 recognized the presence of this information and deemed it collected on July 13, 2019 as per the Order in Council. CSIS then had 90 days to evaluate the foreign datasets it wished to retain, and determine if it wished to evaluate and seek judicial authorization for any bulk Canadian information.

On October 11, 2019, CSIS submitted ten applications for authorization to retain foreign datasets to the Director. The first dataset authorization was approved by the IC on December 16, 2020. In their December 16, 2020, decision, the IC made recommendations regarding the contents of the authorization. One of these recommendations concerned how these datasets collected in [**redacted**] remain likely to assist CSIS in the performance of its duties and functions. The [**redacted**] remaining datasets that had been submitted to the Director for authorization were then edited to include the information requested by the IC. These edits were included as an appendix to the applications. Despite the fact that the edits included material information regarding how the datasets remain likely to assist CSIS in its duties and functions, they were not considered resubmissions to the Director. As of December 2022, CSIS had only submitted two more requests for approval to the IC, totalling three approvals in three years.

CSIS asserted that there were no statutory deadlines that would limit the Director from having these applications for years and that resourcing constraints meant that the requisite edits would take time to complete. This legislative gap has allowed for a parallel mechanism of retention of data that is otherwise strictly governed. While CSIS cannot ingest, query, or exploit the data until the IC approves it, the gap in legislation allows them to query the data in exigent circumstances as per section 11.22 of the CSIS Act.

Furthermore, the legislative gap allowing the authorization request to remain before the Director, un-actioned for years, puts into question how CSIS will meet the “likely to assist” threshold tied to the utility of these datasets. It should be noted that as of April 2023, the dataset approved in 2020 had not been queried, while the one approved in 2021 has been queried only [**redacted**]. This gap in legislation was also noted by the IC, stating: “I am unconvinced that Parliament’s intent was for there to be such a long delay between a request from CSIS for authorization to retain a foreign dataset and the Director’s authorization.”

Recommendation 3: NSIRA recommends that Parliament legislates a time limitation for the authorization of a foreign dataset by the Minister or Minister’s designate.

CSIS dataset Policies

Finding 6: NSIRA finds that CSIS runs the risk of collecting information that is publicly available but for which there may be a reasonable expectation of privacy.

Finding 7: NSIRA finds that CSIS’s policies governing the collection and retention of Canadian and foreign datasets do not align with its current interpretation of the dataset regime.

Finding 8: NSIRA finds that CSIS does not have a policy governing the handling of transitory information. In addition, the existing Interim Direction [**redacted**] does not provide employees with sufficient instruction, which may result in CSIS retaining information that would otherwise be subject to the dataset regime.

CSIS codified in policy its commitment during the enactment of Bill C-59 to not collect hacked or stolen datasets. It acknowledged that there would be a “much higher expectation of privacy associated with those datasets,” and noted that even if adversaries had access to this information CSIS would hold itself to “a higher standard.” However, overall CSIS found itself struggling to implement the provisions of the Act and align its policies and procedures with it.

NSIRA flags four specific concerns. First, the policy center for datasets is the Data Management and Exploitation Branch (DMEX), recently restructured and renamed as [**redacted**]. The dataset policy suite [**redacted**] includes a number of policies pertaining to the identification, collection and retention of section 11.01 datasets. Although the commitment to not collect stolen, hacked or leaked datasets is codified in [**redacted**], there is no corresponding requirement to ensure that information contained in publicly-available datasets (PADs) does not contain information for which there is a reasonable expectation of privacy. Yet, this requirement is especially pertinent when considering the strong emerging market for data purchased through data brokers and the risks associated with purchasing commercially available information that may have been unlawfully collected by said brokers.

Second, as discussed earlier, the shift in CSIS’s position on the relationship between datasets and its regular collection powers has resulted in discrepancies between what information amounts to s.11.01 datasets and what information may be collected pursuant to s. 12. CSIS’s interpretation of the applicability of the dataset regime was reconsidered in 2021, two years after the dataset governing policies were developed. The existing policy suite aligns more with CSIS’s initial position. This has resulted in a policy suite that no longer aligns with CSIS’s current position on the implementation of the dataset regime (discussed above) or with the current structure of the [**redacted**] branch.

Third, the [**redacted**] policy sought to guide and educate employees on the dataset regime. It also placed the onus on “employees who collect the dataset” to determine the appropriate collection authority. This further emphasizes the importance of training received by employees, discussed further below.

Fourth, in 2021, CSIS developed an Interim Direction to support its section 12 collection of datasets. The introduction of this Direction corresponded with the pivot in the interpretation and operationalization of the dataset regime, discussed in section 4 above. The Direction allows for collection of electronic information that has been assessed to be threat-related where threat and non threat information are inextricably co-mingled. It allows for the temporary retention of this information in these circumstances. The direction does not provide any information as to what amounts to inextricably co-mingled information but allows for its sequestered retention for up to [**redacted**] with extension. This non-threat related information would have been subject to the dataset regime, yet the Direction is silent on the requirements of the dataset regime including the connection and relationship to that regime’s 90 day evaluation period. In practice, CSIS does not have a central repository for temporary information, which results in this information being held on unit shared drives absent centralized monitoring, access controls, and auditing. This, along with the constant rotation of employees, lack of training on the Direction, the absence of clear points of accountability and responsibility in the policy, and the [**redacted**] time limitation which greatly exceeds the 90 days limitation in the dataset regime, creates a situation where CSIS risks retaining depositories of information that would otherwise be subject to the dataset regime.

Recommendation 4: NSIRA recommends that CSIS meaningfully analyze and document any possible reasonable expectation of privacy when evaluating publicly available datasets.

Recommendation 5: NSIRA recommends that CSIS develop:

  1. Guidelines regarding the implementation of section 6 of the Interim Direction [**redacted**] that also include consideration of how the Direction’s retention rule is to be reconciled with the 90 day evaluation period in the dataset regime; and
  2. A policy governing the handling of transitory information.

Information Management and Retention

Finding 9: NSIRA finds that CSIS information management practices are responsible for multiple compliance incidents and currently create duplicates of datasets within CSIS’s systems.

Finding 10: NSIRA finds that, as of August 2023, CSIS did not comply with the dataset provisions in the CSIS Act because it retained Canadian information extracted from foreign datasets, and foreign information amounting to a dataset.

Finding 11: NSIRA finds that CSIS did not comply with the dataset provisions in the CSIS Act because it retained Canadian information and referenced it as recently as 2022. This information should have been destroyed upon coming into force of the NSA 2017, in July, 2019.

Finding 12: NSIRA finds that CSIS has not exhaustively scanned all of its systems to identify information that is subject to the dataset regime so that it may be processed in a compliant manner.

From 2018-2019, CSIS conducted an inventory of its holdings to identify information that would be subject to the dataset regime—and therefore need to be deleted— once the regime came into force. CSIS identified several categories of operational reports containing collected Canadian or Foreign information, and developed caveats to insert into the reports indicating that information had been removed.

For foreign datasets, CSIS senior management identified which foreign datasets would be submitted for authorization. Technical analysts conducted a number of exercises on the foreign datasets to test their ability to identify and extract Canadian information as would be required under the dataset regime. These exercises led to the creation of multiple [**redacted**] containing the extracted Canadian data, which was then uploaded [**redacted**] for storage in CSIS’s corporate repository. In doing so, CSIS retained copies of data that should have been deleted.

According to CSIS, duplication is a requirement of CSIS’s information management policy (see Annex A). For example, when a query of a dataset is conducted, CSIS’s information management policy requires analysts to attach the results of the query to the report that gets saved in the operational system. Analysts are also required to save a copy of that report and its attachments to [**redacted**], CSIS’s corporate repository. This has contributed to compliance issues. It also increases the difficulty of deleting information when compliance incidents arise or if CSIS has retained information that is not strictly necessary. Additional examples of where data duplication occurs are described in Annex A.

On September 5, 2019, CSIS assured the Minister that it “undertook significant efforts to ensure compliance with the coming-into force of the dataset framework created by Bill C-59” and that “as a direct result of this exercise, a number of Canadian and foreign datasets were assessed as not meeting the criteria for retention under section 12 or the `likely to assist’ retention threshold under the new dataset framework. These datasets were therefore destroyed prior to coming-into force.” In September 2021, CSIS asserted to NSIRA that all the foreign datasets that were not before the Director for authorization were destroyed.

In [**redacted**] a former DMEX employee discovered [**redacted**] containing a foreign dataset, which had been collected prior to the coming into force of the dataset regime and subsequently submitted for Ministerial authorization. [**redacted**] contained the entire pre-evaluation dataset, including Canadian information. In [**redacted**] another DMEX employee discovered Canadian information extracted from foreign datasets [**redacted**] accessible only by designated employees. These latter records included Canadian information and foreign samples extracted from [**redacted**] foreign datasets, [**redacted**] of which were pending Ministerial authorization, [**redacted**] of which was already approved by the IC, and  of [**redacted**] which were destroyed in their entirety prior to the coming into force of the regime. CSIS destroyed this information because it was unlawfully retained.

These incidents prompted DMEX to conduct a file review “to determine what steps has been taken prior to coming into force of NSA 2017 and what remediation efforts might be necessary. Although employees had been directed to delete potential dataset candidates for which it would not seek authorization to retain with the coming into force of NSA 2017 in July 2019, similar steps had not been taken to direct employees to identify and destroy other copies of datasets and any Canadian or other records removed from these datasets prior to coming into force of NSA 2017 or in the 90 day evaluation period that followed.” DMEX then instructed employees to “conduct a thorough search [**redacted**].” The outcome of these searches was that significant additional Canadian and foreign information was found. This included information pertaining to the [**redacted**] Dataset discussed below. DMEX reported these multiple compliance incidents to CSIS’s review and compliance branch by submitting a fact finding report with supporting material The concluding comments of the report state that a “fulsome” effort was made to identify residual data however [**redacted**] ”.

In October 2022, NSIRA conducted searches of CSIS’s corporate repository and found [**redacted**] files containing tens of thousands of entries of Canadian personal information extracted from [**redacted**] foreign datasets, including information extracted from datasets that have been destroyed, approved by the IC, and pending authorization. The files also contained foreign information. The Canadian information was extracted as part of the exercise to prepare for the coming into force of the Act and should have been destroyed.

NSIRA enquired as to why these files containing Canadian information extracted mostly from destroyed foreign datasets remained in CSIS’s corporate repository and the legal authority under which they are retained. CSIS failed to provide an adequate explanation as to this legal non-compliance, they stated that the information was part of a project in preparation for the coming into force of the dataset regime, and that:

“those Canadian records continue to exist in the PA’d file even though the original  datasets were either all destroyed or sequestered pending Ministerial Authorisation. While certainly contrary to current (since June 2019) s.11 obligations, at that time, this work and retention would have been done under (implicit) s.12 authorities. As this predates the dataset framework, we are unclear if this presents a legal or compliance risk. [**redacted**]

CSIS stated that the records were retained “appropriately at the time, pre C-59, under s.12 implicit authorities”. It is unclear how CSIS distinguishes between the information found by NSIRA and that found by DMEX in [**redacted**] mentioned at paragraph 55 above. As of August 2023, information that NSIRA found in October 2022, containing Canadian and foreign data was being retained by CSIS, in contravention of its legal obligations pursuant to the dataset provisions in the CSIS Act.

NSIRA also searched for operational reports that had been identified prior to the coming into force of the dataset regime as containing information that would amount to Canadian datasets. NSIRA found a number of reports where the information had indeed been deleted and a caveat added. However, NSIRA found [**redacted**] report related to [**redacted**] dataset containing the [**redacted**]. It should be noted that the operational report in question was not sequestered, rather was accessible to all those using the system and was referenced in a report as recently as August, 2022. This would have amounted to a query of what should have otherwise been a Canadian dataset.

NSIRA requested that CSIS provide the authorities under which it is retaining this information. CSIS initially responded that they could not find the report as it had been previously destroyed. Shortly thereafter, CSIS stated that they have found the report and were treating it as a compliance incident. Upon searching the operational system once more, NSIRA found another report containing the [**redacted**] Both reports found by NSIRA contained information that would otherwise amount to a Canadian dataset, [**redacted**]. By retaining this Canadian information, CSIS did not comply with legal obligations pursuant to its dataset regime provisions in the CSIS Act.

The non-compliant information found by NSIRA (Canadian and foreign information from foreign datasets and Canadian information in operational reports) was discovered following CSIS’s initial pre C-59 scan of holdings reported to the Minister and following CSIS’s “thorough search of personal and shared holdings” due to the compliance incident in 2022. CSIS has not exhaustively scanned all of its systems to identify information that is subject to the dataset regime so that it may be processed in a compliant manner.

Recommendation 6: NSIRA recommends that CSIS cease to create duplicates of the information reported in the operational system.

Recommendation 7: NSIRA recommends that CSIS immediately destroy Canadian and foreign dataset information that is not strictly necessary to retain. This information no longer falls within the legal 90 day evaluation period and retaining it pursuant to the dataset regime is no longer a possibility.

Recommendation 8: NSIRA recommends that CSIS conduct an exhaustive scan of its operational and corporate repositories to identify and destroy any non-compliant information.

Training and Resourcing

Training

Finding 13: NSIRA finds that the training required to become a designated employee to evaluate, query, and exploit s. 11.01 datasets offers clear information on collection and retention requirements.

Finding 14: NSIRA finds that CSIS operational personnel, including those predominantly dealing with bulk information collection, have not received adequate training allowing them to identify when collected information may fall within the dataset regime.

Prior to the coming into force of the NSA 2017, including the dataset regime, CSIS developed and implemented specialized training for employees to be designated pursuant to s. 11.06(1) of the CSIS Act, and mandatory Bill C-59 training for all operational employees. CSIS also developed and delivered a number of presentations to assistant directors, management, relevant branches, other government departments, and the Federal Court. This suite of training and presentations align with CSIS’s initial position, discussed above, on the applicability of the dataset regime.

CSIS currently offers two mandatory training courses for the designation of employees. These courses emphasize the distinction between s. 12 “strictly necessary” information and what may be collected pursuant to the dataset regime “likely to assist threshold.” The courses require that an employee familiarizes themselves with the standard operating procedures and requirements of the regime. While online training may not be the ideal training method, the training content along with the mix of standard and scenario based questions offered employees clear instruction on the regime and its requirements.

As noted above, CSIS also implemented mandatory training for all operational personnel. CSIS developed most of the dataset regime training prior to and immediately following the coming into force of the NSA 2017. As discussed at Section 4 of this report, CSIS’s understanding of its statutory obligations pursuant to the regime and how these obligations are perceived and implemented, has changed. The result is that the mandatory training received on a once-and-done basis by operational personnel in 2019 does not align with and may in fact contradict CSIS’s current operationalization and implementation of the regime.

Additionally, the very little training that is received by operational personnel does not allow collectors to determine what information is a dataset despite the onus placed on them to do so. This has resulted in individuals who deal with bulk information collection not being sufficiently aware or trained on the dataset regime.

For intelligence officers, CSIS developed a presentation on the dataset regime as part of the [**redacted**], the mandatory course offered to intelligence officers within a few years of their career [**redacted**]. Initially, when CSIS implemented the training program, employees had to work in groups in a series of workshops to identify the properties of s. 11.01 datasets, including distinguishing them from s. 12 datasets and relating Canadian datasets to approved sets of classes. This training was offered as an instructor-led course until March 2020, after which CSIS removed the workshop component from the updated training program, effectively eliminating any scenario-based questions and exercises. While CSIS has told NSIRA that it is currently working on updating the program, the current training offers little opportunity for collectors to distinguish s.11.01 datasets from s. 12 information.

NSIRA finds that CSIS’s once-and-done approach to training on datasets has resulted in a lack of understanding and sensitization of employees to the dataset regime. CSIS should increase its efforts to sensitize its collectors to the dataset regime requirements and particularities while encouraging them to contact the data exploitation branch when in doubt.

Recommendation 9: NSIRA recommends that CSIS develop and deliver scenario-based workshops to train operational personnel on CSIS’s current application of the dataset regime so that they can engage subject matter experts as necessary.

Resourcing

Finding 15: NSIRA finds that CSIS has not prioritized resourcing the technical unit responsible for the evaluation, query and exploitation of Canadian and foreign datasets.

Finding 16: NSIRA finds that CSIS has not devoted sufficient resources to improving the current technical systems or developing new ones that are equipped to support bulk data use.

In NSIRA’s past review work, issues of training and resourcing often arise together and correlate to an organization’s commitment to a particular program or branch. In April and in November 2022, CSIS informed NSIRA that the Operational Data Analysis Center (ODAC), housed within DMEX and responsible for the technical implementation of the dataset regime including the ingestion, query, and exploitation of datasets was [**redacted**] percent vacancy respectively.

In 2020, no employees were designated for the query or exploitation of datasets despite the authorization and approval of the first foreign dataset. CSIS’s approach to ensuring that they have individuals who are designated and therefore lawfully able to query and exploit information was reactive. In a 2020 verification report provided to NSIRA, CSIS stated that first foreign dataset was authorized by the Director and approved by the IC, yet “there were no employees designated for queries of exploitation of s. 11 Canadian or foreign datasets.

Consequently, no queries or exploitations” of the dataset were conducted. The fact that CSIS had sent its first dataset approval to the IC without having resourced its specialized unit and enabled them to conduct the potential requisite queries and exploitation of the dataset is indicative of [**redacted**]. It took CSIS almost [**redacted**] years to designate an employee for query and exploitation of foreign and Canadian datasets. With the exception of the queries conducted pursuant to the exigent circumstances, no other queries were conducted in 2021.

In November 2022, CSIS expressed concerns that the 90 days provided for evaluation in the Act is too inhibiting and has often resulted in missed collection opportunities. [**redacted**]. Upon further discussion NSIRA was informed that [**redacted**]. Similarly, in 2023 NSIRA was again informed of CSIS’s inability to work within the parameters of the current legislation; in this instance, CSIS had greater resources but had chosen to allocate them to [**redacted**] collection rather than the dataset regime.

The resourcing issues are further compounded by CSIS’s current technical ecosystem. The lifecycle of a dataset involves many different digital tools and systems, [**redacted**] Moreover, these tools and systems can only be customized and maintained by people with niche technical expertise. These compounding factors have created a situation where DMEX employees have limited options for conducting data exploitation, and this has affected the utility of all three categories of datasets. Based on briefings with technical experts and technical demonstrations, it is evident that the current systems are not designed to support bulk data use in a compliant manner.

Recommendation 10: NSIRA recommends that CSIS prioritize resourcing the technical unit responsible for the evaluation, query and exploitation of Canadian and foreign datasets.

Recommendation 11: NSIRA recommends that CSIS prioritize the improvement of current technical systems or development of new systems, equipped to support compliant bulk data use.

Case Study: [**redacted**]

Finding 17: NSIRA finds that CSIS collected information in relation to activities that could not on reasonable grounds be suspected to have constituted a threat to the security of Canada and the collection, analysis and retention of which was not strictly necessary.

Background

[**redacted**]

[**redacted**]

On [**redacted**], CSIS sent a brief to the Privy Council Office and Public Safety outlining the information in [**redacted**] noting that prior [**redacted**].

CSIS [**redacted**]. The brief discusses the possibility of collecting the dataset under section 11, utilizing the 90-day evaluation period to assess whether it is a publicly available or Canadian dataset, and “if retaining and using the dataset for analysis will help ensure the security of Canada.”

The following day, [**redacted**].

[**redacted**], the Director General of the Data Management and Exploitation branch and of [**redacted**] submitted a co-drafted Memo to the Deputy Director of Operations (DDO) seeking the authorization to collect [**redacted**] pursuant to section 12 of the CSIS Act. The memo provides a summary of [**redacted**]. The memo notes [**redacted**] concerns regarding [**redacted**]. While the memo outlines the contents of the dataset as described [**redacted**], it fails to mention [**redacted**] within the database [**redacted**] likely stolen.

The memo quotes [**redacted**]. This statement again contradicts [**redacted**] assessment that information was likely collected for [**redacted**]. Based on that statement, the memo argues: [**redacted**].

Upon receipt of the memo, the DDO requests [**redacted**] ” In response, the DDO notes her concerns that [**redacted**] found no evidence suggesting that the [**redacted**]. The DDO further states that she will accept that the information “may indeed assist” CSIS’s investigation and that while no evidence of [**redacted**], “it is more likely than not” that this is the type of information [**redacted**] “would be interested in.” The DDO approved the collection pursuant to section 12 [**redacted**], CSIS received and ingested the Canadian [**redacted**].

[**redacted**]” It is unclear how this assessment was made, as it does not align with CSIS’s analysis of the [**redacted**], which was used to develop a CSIS Case Report, circulated to partners in government. The report states: “the portion of the dataset referencing Canadians appears [**redacted**]. The brief further notes that [**redacted**]. It should be noted that following the distribution of the Case Analysis Brief, CSIS has not conducted any further intelligence analysis or reporting on the dataset.

Analysis

When CSIS became aware of [**redacted**], the initial discussions focused on the potential collection of the information pursuant to the dataset regime provisions and utilizing the 90 day evaluation period to determine the scope of the dataset, whether it would be a Canadian, foreign, or publicly available dataset. It remains unclear to NSIRA why or what led the discussion to focus instead on a section 12 collection.

At the point of collection, CSIS had limited information regarding the dataset. Much of this information was also conflicting. [**redacted**]. Unfortunately, the full scope of this information was not presented to the DDO when seeking approval for collection pursuant to s.12.

Section 12 of the CSIS Act requires that “The Service shall collect by investigation or otherwise, to the extent that is strictly necessary, and analyse and retain information and intelligence respecting activities that may on reasonable grounds be suspected of constituting threats to the security of Canada.” The threshold to be met is reasonable grounds to suspect. The Supreme Court of Canada has defined a reasonable suspicion as “something more than mere suspicion and something less than a belief based upon reasonable and probable grounds.” It is a “robust standard,” which is “determined by the totality of the circumstances based on the objectively discernable facts.”

Applying the Supreme Court of Canada’s jurisprudence regarding the reasonable suspicion standard to the case at hand, CSIS did not provide any evidence or intelligence to support that the information [**redacted**]. In its analytical tools [**redacted**]. NSIRA found no evidence to support this statement at the point of collection, nor could CSIS explain how they reached said conclusion. That is to say, there were no objectively discernable facts to support that the dataset was indeed connected to a threat to the security of Canada. Rather, CSIS’s explanations to NSIRA, as well as the written records, focus on the potential utility of the information [**redacted**]. CSIS could not provide sufficient evidence to demonstrate how the collection of the information would be strictly necessary pursuant to s. 12. This is best articulated by the DDO’s comments stating that she is “not sold on the rationale” presented to her in the briefing note, but that she was convinced that given the importance of such information to [**redacted**] “it may indeed assist our [**redacted**] investigation of the threat represented [**redacted**]” NSIRA does contend that the information may be of use to [**redacted**] and the analysis of the dataset may be of use to CSIS. However, this dataset does not meet the strictly necessary threshold. Rather, it may meet the s. 11.05 threshold of “relevant to the performance of its duties and functions.”

Furthermore, the CSIS memo to the DDO did not disclose [**redacted**] belief that some of the information was not publicly available and that [**redacted**] may have been “stolen” [**redacted**]. Instead, it focused on [**redacted**]. The memo drafters used [**redacted**] statements to support their belief that there were ties to threat actors [**redacted**]. [**redacted**]. There was no preliminary assessment conducted by CSIS of the dataset as they did not have access to it. [**redacted**] stated [**redacted**] likely “stolen.”. Yet, there was no analysis of the privacy implications of the collection, nor an analysis on whether the collection of this dataset pursuant to section 12 may require a warrant.

Upon collection of the information CSIS analysed the dataset. It should be emphasized that this would have amounted to an exploitation of what should have otherwise been a Canadian dataset.

[**redacted**] the Data Management and Exploitation branch engaged [**redacted**] on the issue of retention of the dataset in light of the requirements in the policy.

[**redacted**]. This statement directly contradicts CSIS’ own assessment of the dataset, which states that [**redacted**]. It proceeds to justify retention by noting that [**redacted**].

A plain dictionary reading of the words “strictly necessary” in s. 12 of the CSIS Act would render a requirement that the information be “rigidly” “indispensable.” However, CSIS did not demonstrate in its justification how the information in the dataset is indispensable to its investigation. Rather, there is a “just in case” type argument put forward that states that it is important to retain the information as it could help a future targeting trend analysis. This justification may meet a likely to assist threshold but does not meet a strictly necessary threshold.

CSIS informed NSIRA that there has been no decision regarding the retention of the dataset, [**redacted**]. NSIRA also learned that should another relevant dataset or associated information arise in the future, at that point [**redacted**]. The dataset is currently in a controlled access shared drive, however no measures are in place to prevent its duplication or movement to other locations.

Recommendation 12: NSIRA recommends that CSIS immediately destroy the case study dataset it collected pursuant to section 12 as it does not meet the statutory thresholds. This information no longer falls within the legal 90 day evaluation period and retaining it pursuant to the dataset regime is no longer a possibility.

Conclusion

In its annual classified report to the Minister, CSIS stated “When considering the challenges with both the exigent circumstances and normal applications of the dataset regime, it is clear that as currently designed, the regime is incapable of managing the volume and variety of data needed to build a robust and sustainable data analytics program, while maintaining Parliament’s intended control and oversight.”

Having been so involved with the drafting of the regime, CSIS was well positioned to develop policies and procedures governing the collection, evaluation, query, exploitation and verification of datasets. NSIRA expected to find a more mature and compliant application of the dataset regime.

As discussed in this report, CSIS has failed to adequately operationalize the dataset regime. While the regime is indeed complex, CSIS has not sought to clarify legal ambiguities [**redacted**] of the application of the regime before the Court when given the opportunity to do so. Rather, CSIS has adopted multiple positions on the application of the dataset regime that risk limiting what is a collection and retention regime to a retention mechanism. Internally, CSIS has not devoted sufficient resources to ensure compliance to the regime, this extends beyond the compliance incidents noted in this report and includes a lack of dedicated technical experts and systems capable of handling and exploiting bulk data. Nor has CSIS devoted adequate resources to sensitizing its employees to the requirements of the regime through training. Absent appropriate training and internal commitment to adequately resource and support the implementation of a new legal regime, any such regime will fail no matter how fit for purpose it is perceived.

Recommendation 13: NSIRA recommends that CSIS share the full unredacted copy of this report with the Federal Court.

ANNEX A: Technical considerations in the lifecycle of Canadian and foreign datasets

This annex describes the technical processes and systems involved with CSIS’s identification, collection, evaluation, retention, querying, exploitation, ingestion, and destruction of Section 11.01 datasets. CSIS uses similar processes and systems for all Canadian and Foreign datasets. The following description of the technical processes and systems involved with the lifecycle of s.11.01 datasets stems from CSIS briefings delivered on 12 May 2022 and 3 October 2022, a technical demo delivered on 1 November 2022, as well as from the policy suite that governs the collection, evaluation and retention of s.11.01 datasets. This annex should be seen as reflective of the technical processes and systems in place until the end of this report’s review period.

Because datasets are defined by Section 2 of the CSIS Act as “a collection of information stored as an electronic record and characterized by a common subject matter,” the scope and breadth of what may be considered a ‘dataset’ is considerable. Some of the technical challenges that CSIS encounters with datasets stem from the variety of data types [**redacted**], and sizes of files [**redacted**] that can comprise a ‘dataset’.

SIS acknowledges that “while comprehensive, there remains residual risk in these complex systems. They are manual, resource-intensive and subject to error. They reflect the complexity of the datasets regime, and offer limited resilience and scalability.”

Identification and Collection

S.11.01 datasets can be identified and collected by CSIS in a number of ways. For example, Service employees can receive datasets from national and international partners or informants via email, USB drives, external hard drives, or other data storage devices. CSIS employees can [**redacted**], encounter a dataset while performing searches on the internet, [**redacted**]. These diverse processes involve any number of technical processes and systems depending on how, where, and by whom the datasets are identified and collected.

Evaluation

DMEX has centralized the s.11.01 dataset evaluation process; one of DMEX’s designated employees must evaluate the dataset within 90 days of its initial collection. During this 90 day period, a designated employee must determine if the dataset meets the requirements for retention as either a Canadian or foreign dataset. The technical processes and systems involved with the evaluation phase vary depending on the format(s), size(s), and location(s) of the dataset. [**redacted**]. Each dataset must be evaluated using techniques and tools suitable to its unique characteristics. If CSIS initially collected multiple versions of the same dataset, DMEX is responsible for ensuring that all other copies of the dataset have been deleted from Service systems.

If the evaluation results lead DMEX to attempt to retain a Canadian or foreign dataset, CSIS must proceed with the requisite applications for approval and authorization. The systems and programs used to develop materials submitted for approvals and authorizations often lead to the creation of substantial documentation (e.g. memos, briefing notes, and affidavits prepared in Microsoft Word or Excel) describing the datasets. In some cases, copies or subsets of information from the datasets are included in the materials submitted for approval and authorization.

To manage and track a dataset’s evaluation workflow, [**redacted**]. For each dataset it evaluates, DMEX [**redacted**].

Retention and Ingestion

Once a Canadian or foreign dataset has been approved for retention, it is ingested [**redacted**], which is CSIS’s [**redacted**] enables CSIS to store and aggregate all of their operational information and datasets, apply access controls to that information, and perform all requisite security logging processes.

All information ingested into [**redacted**] assigned attribute-based access controls that are mapped to CSIS’s [**redacted**] for designated employees who are evaluating a dataset and [**redacted**] for designated employees who can query and exploit the retained datasets. No other employees can access the datasets.

When employees access datasets, CSIS uses [**redacted**] to collect and index information about what they are doing. CSIS collects [**redacted**].

Querying and Exploitation

[**redacted figure**]

Figure 1: Map of [**redacted**] for querying and exploiting foreign and Canadian datasets.

Only ‘designated employees’ can query and exploit Canadian or foreign datasets, and DMEX has centralized these processes. When a Service employee wants to query a s.11.01 dataset in support of an investigation, they must submit a [**redacted**] to DMEX [**redacted**] . Alongside this request, [**redacted**] The information supplied in each [**redacted**] is used to select the appropriate “justification” when a designated DMEX Analyst performs queries or exploitations [**redacted**] or [**redacted**]. [**redacted**]

If the DMEX analyst finds any results from their queries or exploitations, they record [**redacted**]. They must then contact [**redacted**]. [**redacted**]. This manual set of processes creates multiple copies of raw data from datasets, which can be unintentionally retained on Service employees’ desktop computers or in their email sent/received folders.

[**redacted**] Data is compartmentalized (s.12, s.15, s.16, s.17) based on an investigation’s [**redacted**] and retained as per the [**redacted**] rules associated with it.

[**redacted**] CSIS’s corporate repository. This leads to further duplication of raw data from s.11.01 datasets within CSIS’s digital ecosystem.

Destruction

When datasets are initially ingested into [**redacted**], they are assigned a retention period based on whether they are Canadian or foreign. When that retention period ends, [**redacted**].

ANNEX B: Briefings & Interviews

Date Subject
Briefings:
February 17, 2021 Publicly Available Datasets.
September 9, 2021 Foreign Datasets.
April 22, 2022 CSIS Dataset Regime.
May 12, 2022 [**redacted**] Evaluation, Query, Exploitation, Retention & Reporting of Canadian and Foreign Datasets.
October 3, 2022 [**redacted**]
November 1, 2022 Technical Demonstration on Dataset Systems.
[**redacted**] Case Study Briefing.
June 6, 2023 [**redacted**]
Interviews:
August 18, 2022 Canadian dataset.
September 6, 2022 Canadian dataset.
October 14, 2022 Canadian dataset.
October 21, 2022 Canadian dataset.

ANNEX C: Findings & Recommendations

Finding 1: NSIRA finds that CSIS’s current application of the dataset regime is inconsistent with the statutory framework. Recommendation 1: NSIRA recommends that in the next judicial authorization application for a Canadian dataset CSIS put its current position on the application of the dataset regime before the Court, including any use of the information prior to the decision to retain under the dataset regime.
Finding 2: NSIRA finds that CSIS’s current approach to dataset information collection under section 12 risks the creation of a parallel collection mechanism, one that weakens section 12’s statutory thresholds and at the same time lacks the external oversight regime intended to protect personal information under the dataset regime.
Finding 3: NSIRA finds that CSIS failed to fully apprise the Court on their interpretation and application of the dataset regime. CSIS should have sought clarification from the Court as to its views on the precise conduct permissible prior to invocating the dataset regime.
Finding 4: NSIRA finds that when conducting queries in exigent circumstances, CSIS retained information that did not meet the section 12 strictly necessary threshold. Recommendation 2: NSIRA recommends that CSIS immediately destroy any record containing names retained pursuant to the exigent circumstances queries, as they do not meet the strictly necessary threshold.
Finding 5: NSIRA finds that the lack of explicit time limits in section 11.17 of the dataset provisions governing foreign datasets has resulted in datasets being retained for multiple years pending a decision by the Minister or Minister’s designate (the CSIS Director). Recommendation 3: NSIRA recommends that Parliament legislates a time limitation for the authorization of a foreign dataset by the Minister or Minister’s designate.
Finding 6: NSIRA finds that CSIS runs the risk of collecting information that is publicly available but for which there may be a reasonable expectation of privacy. Recommendation 4: NSIRA recommends that CSIS meaningfully analyze and document any possible reasonable expectation of privacy when evaluating publicly available datasets.
Finding 7: NSIRA finds that CSIS’s policies governing the collection and retention of Canadian and foreign datasets do not align with its current interpretation of the dataset regime. Recommendation 5: NSIRA recommends that CSIS develop:
  • Guidelines regarding the implementation of section 6 of the Interim Direction on [**redacted**] that also include consideration of how the Direction’s retention rule is to be reconciled with the 90 day evaluation period in the dataset regime; and
  • A policy governing the handling of transitory information.
Finding 8: NSIRA finds that CSIS does not have a policy governing the handling of transitory information. In addition, the existing Interim Direction on [**redacted**] does not provide employees with sufficient instruction, which may result in CSIS retaining information that would otherwise be subject to the dataset regime.
Finding 9: NSIRA finds that CSIS information management practices are responsible for multiple compliance incidents and currently create duplicates of datasets within CSIS’s systems. Recommendation 6: NSIRA recommends that CSIS cease to create duplicates of the information reported in the operational system.
Finding 10: NSIRA finds that, as of August 2023, CSIS did not comply with the dataset provisions in the CSIS Act because it retained Canadian information extracted from foreign datasets, and foreign information amounting to a dataset. Recommendation 7: NSIRA recommends that CSIS immediately destroy Canadian and foreign dataset information that is not strictly necessary to retain. This information no longer falls within the legal 90 day evaluation period and retaining it pursuant to the dataset regime is no longer a possibility.
Finding 11: NSIRA finds that CSIS did not comply with the dataset provisions in the CSIS Act because it retained Canadian information and referenced it as recently as 2022. This information should have been destroyed upon coming into force of the NSA 2017, in July, 2019.
Finding 12: NSIRA finds that CSIS has not exhaustively scanned all of its systems to identify information that is subject to the dataset regime so that it may be processed in a compliant manner. Recommendation 8: NSIRA recommends that CSIS conduct an exhaustive scan of its operational and corporate repositories to identify and destroy any non-compliant information.
Finding 13: NSIRA finds that the training required to become a designated employee to evaluate, query, and exploit section 11.01 datasets offers clear information on the collection and retention requirements. Recommendation 9: NSIRA recommends that CSIS develop and deliver scenario-based workshops to train operational personnel on CSIS’s current application of the dataset regime so that they can engage subject matter experts as necessary.
Finding 14: NSIRA finds that CSIS operational personnel, including those predominantly dealing with bulk information collection, have not received adequate training allowing them to identify when collected information may fall within the dataset regime.
Finding 15: NSIRA finds that CSIS has not prioritized resourcing the technical unit responsible for the evaluation, querying, and exploitation of Canadian and foreign datasets. Recommendation 10: NSIRA recommends that CSIS prioritize resourcing the technical unit responsible for the evaluation, querying, and exploitation of Canadian and foreign datasets.
Finding 16: NSIRA finds that CSIS has not devoted sufficient resources to improving the current technical systems or developing new ones that are equipped to support bulk data use. Recommendation 11: NSIRA recommends that CSIS prioritize the improvement of current technical systems or development of new systems, equipped to support compliant bulk data use.
Finding 17: NSIRA finds that CSIS collected information in relation to activities that could not on reasonable grounds be suspected to have constituted a threat to the security of Canada and the collection, analysis, and retention of which was not strictly necessary. Recommendation 12: NSIRA recommends that CSIS immediately destroy the case study dataset it collected pursuant to section 12, as it does not meet the statutory thresholds. This information no longer falls within the legal 90 day evaluation period and retaining it pursuant to the dataset regime is no longer a possibility.
Recommendation 13: NSIRA recommends that CSIS share the full unredacted copy of this report with the Federal Court.

Share this page
Date Modified:

Review of the Canadian Forces National Counter-Intelligence Unit – Operational collection and privacy practices

Completed Reviews

Review of the Canadian Forces National Counter-Intelligence Unit – Operational collection and privacy practices


Date of Publishing:

Executive Summary

This review focused on the Canadian Forces National Counter-Intelligence Unit (CFNCIU) and how Information Technology (IT) searches were used to support counter-intelligence (CI) investigations. The review assessed whether IT searches and the collection of information in support of CI investigations interfered with individuals’ reasonable expectation of privacy in the circumstance(s).

Through the course of the review NSIRA has identified three (3) areas of concern tied to the requests for, and conduct of, CI information technology network searches. These are arranged under the following categories: (1) CFNCIU’s search of a Subject’s email, Internet and removable device activity; (2) The CFNCIU checklist used to identify and restrict search parameters, and how applicable stakeholders define search parameters; and, (3) How the acquisition of information is used to expand supplementary searches.

DND employees and CAF members have a reasonable expectation of privacy when using work computers for personal use. [**contains information related to DND/CAF operational capabilities**]. NSIRA found that CFNCIU may be inappropriately relying on DND/CAF policies as lawful authority to interfere with a Subject’s reasonable expectation of privacy.

NSIRA observed that the checklist has the potential to capture intimate and personal information that touches upon a Subject’s biographical core. NSIRA found that the checklist risks capturing information that is protected by s. 8 of the Charter. NSIRA also found that DND/CAF is applying a definition of metadata that captures information that could be subject to a reasonable expectation of privacy.

NSIRA also observed that CFNCIU IT inquiries utilized broad search parameters which may include information not relevant to the investigation. These parameters were applied as broad approvals with no specific internal controls or oversight at both the operational and working levels. Collection techniques, due in part to the limitations of IT audit tools and broad search parameters, resulted in a wide net being cast. NSIRA found that the investigative IT system practices it observed in the context CFNCIU’s CI investigations [**contains information protected by solicitor-client privilege**] have  insufficient legal oversight to ensure that they are as minimally invasive as possible.

As a result of these findings, NSIRA recommends that DND/CAF suspend investigative IT system practices in the context of CFNCIU CI investigations until a reasonable legal authority has been established. Once a reasonable legal authority has been established DND/CAF should create a new policy framework that is reflective of the noted findings.

In keeping with NSIRA’s 2020 Annual Report which emphasized the implementation of a “trust but verify” approach for assessing information provided over the course of a review, NSIRA worked with the DND/CAF to design an approach for “proxy access” i.e. an approach involving a departmental intermediary an intermediary who accesses information repositories in the presence of NSIRA staff, and who can review relevant information on the system. DND/CAF agreed in principle to this form of access, however, given the disparate number of databases for which CI searches are conducted, this initiative could not be implemented in the course of this review. Notwithstanding, the information provided by DND/CAF has been independently verified by NSIRA through documentation analysis and meetings with DND/CAF subject matter experts. Further work is underway to continue mutually developing an access model for the independent verification of various kinds of information.

Authorities

This review is being conducted under the authority of paragraph 8(1)(b) of the National Security Intelligence Review Agency Act (NSIRA Act).

Review background

In July 2019, the NSIRA Act came into force, establishing the National Security Intelligence Review Agency (NSIRA). NSIRA’s mandate allows it to review the full range of national security or intelligence activities across the Government of Canada, including authority to review the Department of National Defence / Canadian Armed Forces (DND/CAF).

NSIRA completed its first review of DND/CAF in 2020, focusing on the Canadian Forces National Counter-Intelligence Unit (CFNCIU). During the course of the review, two (2) possible compliance issues were identified, with NSIRA Members approving further review in 2021.

The issues identified for further review were:

  • the practice by CFNCIU, Assistant Deputy Minister Information Management [ADM(IM)] and DND/CAF of requesting information from, and searching DND/CAF Information Technology (IT) systems in support of Counter-Intelligence (CI) investigations; and,
  • 2014 CFNCIU Subject interview [**contains information related to DND/CAF operations**]

IT System Searches

This review assessed, both in legal and technical terms, how IT searches are used to support CI investigations and the accountability structures that guide the acquisition of information and data.

Through the course of this review NSIRA examined all available written and electronic records, case files, correspondence, computer databases, and other information holdings and documentation related to the operations/investigations selected for review, as well as applicable policies, procedures, and legal advice to verify compliance with legal, ministerial and policy requirements. Presentations, interviews and meetings were conducted with managers/officers, as well as other pertinent DND/CAF personnel.

Through examination of selected case files, the review assessed whether IT searches and the collection of information in support of CI investigations interfered with individuals’ reasonable expectation of privacy in the circumstance(s). More specifically, NSIRA closely examined whether the searches used to support counter-intelligence (CI) investigations had the potential to include information that is meaningful, intimate and touching on a user’s “biographical core” of personal information. Everyone in Canada is constitutionally entitled to expect privacy in personal information of this kind, including when this information is contained on workplace computers.

NSIRA selected a sample of CFNCIU’s requested IT system searches, to assess whether CFNCIU, in the course of its activities, acted in compliance with the law, ministerial direction, and internal directives, policies and procedures, and had exercised its powers in a manner that is consistent, reasonable and necessary.

The review examined a cross-section of CFNCIU case files, and has focused on a contemporary, high level (Level III) case file [**redacted**] to illustrate CFNCIU and ADM(IM)’s practices when conducting searches on IT systems (Please refer to Appendix 1 for more on this case file). Through the lens of [**redacted**], NSIRA has examined whether CFNCIU and/or ADM(IM) interfered with individuals’ reasonable expectation of privacy in the circumstance(s) through the course of CI investigation. NSIRA closely examined searches conducted by Department of Information Management End- User Services (DIMEUS), Directorate of Information Management Engineering and Integration (DIMEI), and Canadian Forces Network Operations Center (CFNOC).

Subject interview

NSIRA also conducted an in-depth examination of the 2014 CFNCIU Subject interview in order to understand the lead up to the interview, what happened during the interview, the possible consequences, and what was done by DND/CAF after the incident. NSIRA reviewed CFNCIU’s case file and its compliance with relevant legislation, Ministerial Directives, DND/CAF policy, as well as the legal advice provided by the Office of the Judge Advocate General (OJAG) and the Canadian Forces Legal Advisor (CFLA).

As a direct result of NSIRA’s inquiries, the Canadian Forces Intelligence Command (CFINTCOM) issued a directive on September 9th 2021, [**contains information related to DND/CAF operations**].

In NSIRA’s view these measures have addressed the initial concerns exemplified in the 2014 Subject interview referenced above. As a result, NSIRA has suspended further inquiry into the matter, however, NSIRA may choose to re-examine this investigative practice in future reviews after an updated functional directive is provided by CFINTCOM.

CFNCIU historical context

Since 1997, Counter-intelligence (CI) and security functions within the DND/CAF have experienced continuous transformation in an effort to find efficiencies and de-conflict with other security, intelligence, and law enforcement stakeholders. Since inception, the CFNCIU has been the subject of ten internal studies, each of which have identified the Unit as having suffered from resource and policy limitations (among others), resulting in an inability to fully meet its mandate. Very few of the recommendations presented in these reports have be implemented. When asked why so many recommendations were ignored the Unit cited resourcing shortfalls.

In 1997, the security and criminal investigative services that had resided within the Special Investigations Unit (SIU) were separated into two new and distinct units, the CFNCIU and Canadian Forces National Investigative Service (CFNIS). This was a direct result of the tabling of the Report of the Special Advisory Group on Military Justice and Military Police Investigation Services, and the External Review of the Canadian Forces Special Investigation Unit.

The separation mirrored the bifurcation that occurred in the mid-eighties between the Royal Canadian Mounted Police (RCMP) and CSIS. For the first time, separate and distinct mandates within the DND/CAF were created for law enforcement, security and counter intelligence, and security clearance functions.

The newly created CFNCIU assumed the role of the security and counter intelligence functions within the DND/CAF. The CFNIS focused solely on criminal investigations. Finally, the security clearance function was established and now known as the Director General Defence Security, the Director Personal Security and Identification Management (DGDS/DPSIM).

The formation of the CFNCIU is authorized by the Minister of National Defence (MND) through a Ministerial Organization Order. Subsequently, the Chief of the Defence Staff (CDS), through a Canadian Forces Organization Order, established the CFNCIU as a regular force unit allocated to the Canadian Forces Intelligence Group (CF INT GP).

Issued in March of 2003, under the authority of the Deputy Chief of the Defence Staff, the 8002 series Defence Administrative Orders and Directives (DAOD) established the main policy framework for defence CI activities by reaffirming responsibilities of the MND, DM and CDS in safeguarding the resources of DND/CAF. [**contains information protected by solicitor-client privilege**] would be equivalent to those undertaken by departmental security officers in other federal government departments.

There are no provisions of the National Defence Act (NDA) that authorize the conduct of defence intelligence activities. CFNCIU investigations are the only area of defence intelligence that is squarely focused on Canadian citizens (DND employees/CAF members). [**contains information protected by solicitor-client privilege**]

In addition, Canadian law imposes legal constraints under the Privacy Act, the Criminal Code and the Charter on intelligence activities conducted in support of domestic operations. For example, the application of the interception of private communications provisions under the Criminal Code and the application of section 8 Charter protections against unreasonable search and seizure, would apply to domestic activities of DND/CAF.

Issued in July of 2012, under the authority of the Assistant Deputy Minister (Information Management) and the Chief Information Officer, the 6002 series Defence Administrative Orders and Directives (DAOD) establishes the main policy framework for operational, technical and security authorities for communications and information systems within the DND/CAF.

DAOD 6002-2, Acceptable Use of the Internet, Defence Intranet, Computers and Other Information Technology Systems, provides users with instructions on official, authorized, unauthorized and prohibited uses of IT systems. It is this policy that defines authorized use and a user’s expectation of privacy.

In DAOD 6002-2, users are advised that authorized use includes communication with family, friends and other persons, conducting personal banking transactions, as well as shopping for personal and family items, and would fall within the other than official uses category. Users are also advised that that there is only a limited expectation of privacy afforded due to the department’s responsibility for monitoring IT systems for the purposes of system administration, maintenance and security, and to ensure compliance with Treasury Board, DND/CAF policies, instructions, directives and standards.

Investigative process

Threat related information comes from a variety of sources to CFNCIU. Such information can originate from different detachments as well as from external partners. On initial receipt of threat-related information about a DND/CAF employee and/or incident, the Regional Detachments (RD) drafts an Intelligence Report (IntRep) to Headquarters (HQ), which centrally manages all investigations.

Following the initial identification of this security concern, there are two key determinatives to launch an investigation:

  • there must be a suspicion linking an activity/individual as a threat (i.e. Terrorism, Extremism, Subversion, Sabotage, and Organized Crime) known as a TESSOC; and,
  • the suspected threat must have a clear “nexus” to DND/CAF information, people and/or assets.

When operating within this scope, the nexus must be established for every investigation. [**contains information protected by solicitor-client privilege**].If the TESSOC and nexus determinations are sufficiently justifiable, the Regional Detachments will submit a request outlining the proposed investigative level.

The investigative framework for CFNCIU is unique insofar as it covers security intelligence concerns similar to those of CSIS (i.e. TESSOC, in addition to organized crime), yet is limited in investigative scope to DND/CAF information, people and assets (i.e. nexus). Unlike CSIS, CFNCIU does not collect expansively on threats given the need for a nexus; and unlike a Departmental Security Officer, CFNCIU does not conduct investigations on issues regarding policy compliance, or security issues involving inappropriate behaviour by employees that do not point to an obvious TESSOC. Furthermore, CFNCIU does not have responsibility for security screening (which is the responsibility of DGDS/DPSIM), or for criminal investigations, which is the responsibility of the Canadian Forces National Investigation Service (CFNIS).

The investigative scope of CFNCIU is therefore best understood as occupying a very narrow space above those related to discipline and security screening, yet falling below criminal thresholds. Prior to the authorization of a counter-intelligence investigation or operation, DND/CAF must determine that:

  1. The investigation complies with the law;
  2. Any investigative techniques are related to the threat posed and the probability of its occurrence;
  3. The need to use intrusive techniques is weighed against any possible breach of constitutionally protected rights and freedoms; and
  4. The least intrusive technique of information collection are used, taking into account the specific circumstance.

The following text box summarizes the various investigative levels and what activities are authorized by departmental policy to be performed within that investigative threshold:

CFNCIU - Redacted Figure 1 : Investigative process

Although the levels of investigation are temporal, the review observed that most investigations are contained within the lowest investigative thresholds (i.e. PA or L1). This is not due to an absence of serious TESSOC threats but rather, this is due, in part, to CFNCIU’s [**redacted**] legal authorities [**contains information related to DND/CAF operational capabilities**].

When CFNCIU was created in 1997, the legal landscape with regard to the Charter was much different than it is today, and technology has expanded in a way that computers have become an all-encompassing tool. In addition, surveillance capacity and techniques have evolved. The law has evolved accordingly to protect Charter rights by requiring the State to obtain specific judicial authorizations (warrants) where there is a reasonable expectation of privacy.

[**contains information protected by solicitor-client privilege**]

  1. [**redacted**]
  2. [**redacted**]
  3. [**redacted**]
  4. [**redacted**]
  5. [**redacted**]
  6. [**redacted**]
  7. [**redacted**]
  8. [**redacted**]
  9. [**redacted**]
  10. [**redacted**]

[**contains information protected by solicitor-client privilege**] Warrantless searches that interfere with a reasonable expectation of privacy are presumptively unreasonable, unless the Collins test criteria is satisfied. CFNCIU has not identified a clear lawful authority that would permit warrantless searches for section 8 purposes during CI investigations. It is clear that under this evolved legal landscape that CFNCIU’s authorities have not kept up with the articulated mandate. The Unit, and largely CFINTCOM, have acknowledged that policy is outdated in terms of both terminology and content. NSIRA notes, however, that updating internal policies would not provide adequate authorities to conduct activities that would amount to a lawful interference with Charter rights. Amendments to allow CFNCIU to conduct most activities that would fall under a Level 2 or Level 3 investigation would require legislative amendments. This was documented within a number of internal reports identifying significant discrepancies in policy.

This explains why the Unit relies on the policies and legal authorities of external investigative bodies when carrying out certain functions, including those that would require a warrant. For example, CFNCIU cannot [**contains information related to DND/CAF operational capabilities**] these investigative techniques are all facilitated through other investigative bodies and these bodies’ mandates (i.e. CFNIS, CSIS, etc.).

This contemporary review NSIRA REVIEW 2021-10 should be viewed as a continuation to NSIRA’s 2019 review, the Canadian Forces Counter-Intelligence Unit (2019-01). As a result of the challenges posed by the COVID-19 pandemic and access to DND/CAF’s IT/IM infrastructure, NSIRA elected to bifurcate the review. This separation allowed for the provision of findings and recommendations to the Minister of National Defence in February of 2021. While the DND/CAF have accepted all of the findings and recommendations from the 2019 review, NSIRA recognizes this current review follows in relatively short succession and changes may already be underway. The intent of this review is not to restate previous findings and recommendations, but to provide additional observations viewed through an operational context.

This review examined a cross-section of CFNCIU case files, and has focused on a contemporary, high level (Level III) case file [**redacted**] to illustrate CFNCIU and ADM(IM)’s practices when conducting searches on IT systems (Please refer to Appendix 1 for more on this case file).

Through the lens of [**redacted**] NSIRA has examined whether CFNCIU and/or ADM(IM) interfered with an individuals’ reasonable expectation of privacy in the circumstance(s) through the course of CI investigation. NSIRA closely examined searches conducted by Department of Information Management End-User Services (DIMEUS), Directorate of Information Management Engineering and Integration (DIMEI), and Canadian Forces Network Operations Center (CFNOC) on behalf of CFNCIU for CI purposes.

NSIRA selected a sample of CFNCIU’s IT system searches, to assess whether CFNCIU, in the course of its activities, acted in compliance with the law, ministerial direction, and internal directives, policies and procedures, and had exercised its powers in a manner that is consistent, reasonable and necessary.

Findings and recommendations

This review focuses on CFNCIU searches of the Defence Wide Area Network (DWAN). This unclassified network allows for personal use by DND/CAF employees in accordance with internal policy. CFNCIU submits requests to three units which have the capability to query the DWAN activity and provide reports on specific users, and Subjects of investigation(s). The three internal units reviewed included the Department of Information Management End-User Services (DIMEUS), Directorate of Information Management Engineering and Integration (DIMEI), and Canadian Forces Network Operations Center (CFNOC).

Through the course of the review NSIRA has identified three (3) areas of concern tied to the requests for, and conduct of, CI information technology network searches. These are arranged under the following categories:

  1. DWAN searches: CFNCIU’s search [**contains information related to DND/CAF operations**]
  2. Multi-point Checklist: The CFNCIU checklist used to identify and restrict search parameters, and how applicable stakeholders define search parameters; and,
  3. Expanded Search: How the acquisition of information is used to expand supplementary searches.

DWAN Network Searches

CFNCIU requests advanced IT system searches as an investigative tool when conducting CI investigations. This potentially includes searches across [**redacted**] networks across multiple classification levels (See Annex F: IT SYSTEMS MATRIX). In the context of investigations, searches are best described as mosaics compiled from the previously mentioned distinct internal groups: DIMEI CFNOC, and, DIMEUS.

When conducting a CI investigation, CFNCIU must engage these groups individually through separate requests. Each group has a separate process for searching, collecting and reporting information. DIMEI, DIMEUS and CFNOC may lawfully access and monitor IT system searches for the purpose of “the management or protection of computer systems,” and may take reasonable measures for such purposes, including the interception of private communications. However, DIMEI, DIMEUS and CFNOC’s access to DND/CAF IT systems for network security activities does not provide an authority to access those IT systems for the purposes of [**redacted**]

The process for IT system searches, as described by CFNCIU, is illustrated by the figure below:

[**redacted figure**]

Generally DIMEI, DIMEUS and CFNOC utilize similar processes for providing “remits” – i.e. the collected product – to CFNCIU across IT systems. At the collection and filtering stage it is the IT analyst (DIMEI, DIMEUS, CFNOC) that decides what information is included as part of the remit. Analysts retrieve data from the Subject’s repositories based on a set of predefined selectors which is stipulated in a multi-point checklist (discussed further below) and relevance to the request is ultimately determined by the analyst’s post- collection review. [**contains information protected by solicitor-client privilege**]

While CFNOC engages its legal counsel with the initiation of CFNCIU’s request, they do not appear to be engaged with, or consulted through the course of the investigation [**contains information protected by solicitor-client privilege**] DIMEUS and DIMEI do not have assigned legal review, or oversight, and rely on the checklist to support their collection and filtering activities. DND/CAF notes that legal advice is sought by CFNOC and may be requested by DIMEUS and DIMEI, including verbally, [**contains information protected by solicitor-client privilege**]. However, NSIRA cannot verify this claim.

A Reasonable Expectation of Privacy when using IT Systems

Importantly, CFNCIU IT searches may not interfere with an individual’s Charter rights. As noted above, this review examined whether searches of the unclassified DWAN network for CI purposes had the potential to infringe upon an individual’s reasonable expectation of privacy in the informational content included on workplace computers. Case law recognizes that an individual’s use of workplace computers for personal purposes may give rise to a reasonable, though diminished expectation of privacy, protected by s. 8 of the Charter. A reasonable expectation of privacy inquiry is fact-sensitive and fact-specific, and depends on the “totality of the circumstances”.

It is likely that users of DND/CAF unclassified IT systems have a reasonable expectation of privacy when using such systems for personal use. DND/CAF policy on acceptable use of computer systems and devices permits limited personal use of such systems for a range of personal activities that are not necessary to carry out duties and official functions in furtherance of DND and CAF goals and objectives. This can include communicating with family, friends and other persons, for other than official use; shopping for personal and family items; or accessing news and other electronic network information sources. Such authorized activities (i.e, those for personal purposes) can generate revealing and meaningful private information that falls within the “biographical core” of information protected by section 8 of the Charter. A Subject under investigation by CFNCIU, therefore, would be able to establish a direct interest and a subjective expectation of privacy in any information content searched related to the personal use of DND/CAF networks.

DND Employees and CAF members have a reasonable expectation of privacy when using work computers for personal use. DND/CAF policy recognizes that:

“[t]here is only a limited expectation of privacy when using IT systems because they are subject to monitoring for the purposes of system administration, maintenance and security, and to ensure compliance with the Treasury Board, DND and CAF policies, instructions, directives and standards.”

A limited, or diminished, expectation of privacy is nonetheless a reasonable expectation of privacy protected by section 8 of the Charter. [**contains information protected by solicitor-client privilege**]

NSIRA acknowledges that DND/CAF has a legitimate interest in safeguarding the resources of DND and the CAF. However, the “finer points” of an employer’s right to monitor computers issued to employees has been left by the Supreme Court for another day. While the law on employee computer searches continues to evolve, a reasonable expectation of privacy is subject to state intrusion only under the authority of a reasonable law.

A search carried out without a warrant is presumptively unreasonable and contrary to s. 8 of the Charter. In the absence of a warrant, the Crown must establish on a balance of probabilities (1) that the search was authorized by law; (2) that the authorizing law was itself reasonable; and (3) that the authority to conduct the search was exercised in a reasonable manner. NSIRA is concerned that CFNCIU has not adequately considered their legal authorities to determine whether they have reasonable lawful authority to conduct warrantless searches for CI purposes.

As CFNCIU [**contains information protected by solicitor-client privilege**] and therefore CI activities would not constitute an unreasonable search within the meaning of s. 8 of the Charter.

[**contains information protected by solicitor-client privilege**]

[**contains information protected by solicitor-client privilege**]

CFNCIU [**redacted**] for CI activities, and is not clearly authorized by law to intrude upon a Subject’s reasonable expectation of privacy. NSIRA notes that the objective of the Treasury Board Policy is to manage government security, which is distinct from intelligence-gathering. Further, NSIRA emphasizes that internal policies– even those that “reflect and instantiate broader Treasury Board Policy on Government Security” – are likely not adequate authorities to conduct CI activities that allow for an interference with Charter rights. [**contains information protected by solicitor-client privilege**] While the CFNCIU search is not for criminal purposes, the strict requirement to report wrongdoing to the authorities would likely aise the standards for protections under section 8 of the Charter.

[**contains information protected by solicitor-client privilege**]

[**redacted**] Searches

In [**redacted**], the Counter-Intelligence Oversight Committee (CIOC) authorized a Level III CI investigation codenamed [**contains information related to national security investigations**].

[**contains information related to DND/CAF operations**]

[**contains information protected by solicitor-client privilege**]

[**contains information protected by solicitor-client privilege**]

[**contains information protected by solicitor-client privilege**]

Finding 1: NSIRA found that CFNCIU is inappropriately relying on DND/CAF policies as lawful authority to interfere with a Subject’s reasonable expectation of privacy.

Multi-Point Checklist

The multi-point checklist is applied as a standard operating procedure that sets out the parameters used to capture CFNCIU IT search requests, by aligning technical search capabilities with DND/CAF’s existing cyber defence tools.

The checklist identifies IT inquiry questions to be answered in retroactive analysis reports on Subjects of investigation. The multi-point checklist is viewed as a list of pre-consulted IT support requests and associated search criteria that has been reviewed [**redacted**] The checklist serves as a basis for all CFNCIU requests to DIMEI and DIMEUS by aligning the specific information request to the allowable search criteria, all the while falling within CFNCIU’s mandate and legal authorities. CFNCIU has indicated [**redacted**].

[**contains information protected by solicitor-client privilege**]

[**redacted**] DIMEUS and DIMEI do not have imbedded legal counsel, and rely on legal counsel from Directorate of Law/ Intelligence and Information Operations (DLAW/I&IO), or legal counsel from headquarters within ADM(IM) through CFNCIU.

CFNCIU distinguishes metadata from content as “…the attributes of the content without revealing the content.”  Their view is that because the metadata does not include content, it is claimed by CFNCIU to be less sensitive. Metadata, [**redacted**] is returned to CFNCIU as a list of all emails sent or received by the Subject, including all the email metadata attributes such as the sender, the recipient, as well as the subject line and any attachment names.

NSIRA notes that metadata can be just as revealing as content about a Subject’s biographical core, depending on the context. Information that might appear outside of the biographical core of a Subject may be revealing or intrusive when coupled with other information. When viewing the information compiled by the checklist in its entirety, it is possible that intimate personal information related to the Subject under investigation may be revealed beyond what was initially contemplated or authorized. Additionally, email subject lines are akin to content rather than metadata. An email subject line can reveal the content of the communication that it describes, and it can be just as sensitive as any communication contained within an email. Therefore, it is inaccurate to consider email subject lines as metadata, rather than content.

It is important to note that DIMEUS analysts, during the filtering process, assesses relevance based on the Subject’s email metadata, [**redacted**] DIMEI has a similar process where returns are filtered to include only metadata related to the Subject. DIMEUS and DIMEI, as mentioned above, do not have integrated legal support. NSIRA notes that the practice of DIMEUS and DIMEI analysts filtering information for relevance – and in some cases, to ensure the results do not include content – is an inappropriate method for conducting IT searches, as it is likely to intrude upon the Subject’s privacy interests (further discussed below). The proposed checklist selectors are applied to all DIMEI and DIMEUS search requests by means of a standardized template. These selectors are used as filters that are applied to each search. Data returns only include the selector, or an iteration of that selector. Noteworthy, is the practice of DIMEI, which if a date range is not specified by CFNCIU, all records irrespective of time period are provided. In practice, there is in fact no constraint on the metadata being provided to CFNCIU in this scenario. This appears to contradict two checklist items which limit the information requests to the inquiry period.

[**contains information protected by solicitor-client privilege**]

Ultimately, current CFNCIU IT policy [**redacted**] on IT searches [**contains information protected by solicitor-client privilege**]. Further, IT searches based on use of the checklist are not subject to additional legal consultation or oversight (beyond the creation of the checklist template) [**redacted**]. This is problematic as the checklist items as drafted may capture information that has the potential to reveal intimate details of the lifestyle and personal choices of the Subject, which would be protected by section 8 of the Charter.

For example, item 8 of the checklist is [**contains information protected by solicitor-client privilege**]. Such an approach may still reveal information for which a Subject has a reasonable expectation of privacy. [**contains information protected by solicitor-client privilege**].

It is important to note that CFNCIU, during the course of the [**redacted**] investigation, submitted a request to CFNOC that included [**contains information related to DND/CAF operations**] CFNOC reminded CFNCIU that a reasonable expectation of privacy existed and ‘fishing expeditions were prohibited. This resulted in the withdrawal of the request for [**redacted**] with CFNOC. By contrast, CFNCIU requested similar information from DIMEI who complied and provided [**redacted**]. Although these two requests were not issued concurrently, they clearly demonstrate two separate outcomes based on very similar CI requests.

In contrast to DIMEUS and DIMEI’s approach, CFNOC operates under their own policies, directions and standard operating procedures, and need to meet specific requirements before a CFNCIU request can be initiated. For example, unlike DIMEI and DIMEUS, the CFNOC process includes an initial legal review by their CFIOG JAG [**redacted**].

[**contains information protected by solicitor-client privilege**]. NSIRA notes that the CFNOC approach to receiving initial legal review by their CFIOG JAG in the context of an investigation is preferable to DIMEUS and DIMEI’s approach [**redacted**].

Given the risk that the checklist items and proposed selectors have the potential to capture intimate and personal information that touches upon a Subject’s biographical core, the use of the checklist outside of the initially agreed upon parameters and without additional legal guidance or approval is problematic.

Finding no. 2: NSIRA found that the DND/CAF checklist applied as a standard investigative operating procedure risks capturing information that is protected by s. 8 of the Charter.

Finding no. 3: NSIRA found that DND/CAF is applying a definition of metadata that captures information that could be subject to a reasonable expectation of privacy.

CFNCIU has taken measures to constrain its search parameters over the course of the [**redacted**]. Initial Requests For Information (RFI) (before the multi-point checklist was constituted) included far-reaching and extensive search parameters. From 2014, to the introduction of the checklist RFI items included [**contains information related to DND/CAF operations**] was included as part of the RFI. The [**redacted**].

In [**redacted**] a month prior to the authorization of the [**redacted**] investigation, CFNCIU investigators discussed the contents of the associated RFI and highlighted their preference to [**contains information related to the DND/CAF operations**].

DND/CAF has made attempts to constrain the search parameters with the implementation of the multi-point checklist. However, even with the checklist, the CFNCIU IT inquiry requests for the [**redacted**] investigation utilized broad search parameters which may have included information not relevant to the investigation.

[**contains information protected by solicitor-client privilege**]

Filtering the data for relevancy after this initial collection and search has occurred poses legal risks, as any potential interference into the Subject’s reasonable expectation of privacy would have already occurred by state action. The post-filtration of the information by the IT analyst before it is returned to CFNCIU does not negate that this initial search and seizure of the information by the IT analyst already constitutes a ‘search’ and ‘seizure’ within the meaning of s. 8 of the Charter, if this search interfered with a reasonable privacy interest.

These parameters are applied as broad approvals with no specific internal controls or oversight at both the operational and working levels. Collection techniques, due in part to the result in a wide net [**redacted**] being cast. It is left to the analyst/investigator to determine what is relevant and filter results after the information/data has been collected.

NSIRA has observed six instances of expanded search criteria, either outside of the stipulated checklist criteria or outside the initial request to CFNOC, as illustrated in Appendix II: Expanding the Search: [**redacted**] – Specific Examples, with no additional legal consultation, yet with clear risk of intruding upon Charter interests. As previously mentioned, the use of broad search parameters and then subsequent filtration of ‘relevant’ information is not an appropriate investigative technique. Furthermore, this approach does not align with DND/CAF policy on the CI program to ensure that prior to investigation or operation, the need to use intrusive techniques is weighed against a possible breach of constitutionally protected rights; and the least intrusive technique of information collected is used, taking into account the specific circumstances.

Finding 4: NSIRA found that CFNCIU risks breaching protected privacy interests by not having clear policy guidance based on lawful authority for IT searches, and by expanding IT searches beyond the approved search parameters.

Finding 5: NSIRA found that the investigative IT system practices it observed in the context CFNCIU’s CI investigations contradict the Office of the JAG and the Department of Justice’s legal advice, [**contains information protected by solicitor-client privilege**]

Recommendation 1: NSIRA recommends that DND/CAF suspend investigative IT system practices in the context of CFNCIU CI investigations until a reasonable legal authority has been established.

Recommendation 2: Once a reasonable legal authority has been established DND/CAF should create a new policy framework that is reflective of the noted findings, namely, the multi-point checklist, the categorization of metadata, the expansion of IT searches and the principle that these searches be as minimally invasive as possible.

Appendices

Appendix I: [**redacted**]

On [**contains information related to national security investigations**]

[**contains information related to national security investigations**]

In [**redacted**] the CIOC authorized a level III CI investigation codenamed [**contains information related to DND/CAF operations**].

DND/CAF, through its coordination body National Security and Intelligence Review and Oversight Coordination Secretariat (NSIROCS), has provided a large amount of documents in response to our Requests for Information. It is however also important to note that the information provided has not been independently verified by NSIRA.

[**redacted diagram and table containing information related to DND/CAF operations**]

Appendix II: [**redacted**] – Specific Examples

[**contains information protected by solicitor-client privilege**]

DIMEI 3-5 provided [**redacted**] in [**redacted**] DIMEI 3-5 further elaborated with the release of the information that the report was generated from [**contains information related to DND/CAF operations**]

Between [**redacted**] CFNOC provided CFNCIU with information in response to the IT inquiry request. This included [**contains information related to DND/CAF operations**].

On [**redacted**] CFNCIU requested from CFNOC “a master spreadsheet of all emails with subject headings to date.”112 This request did not include the initially agreed upon search criteria. CFNOC agreed to this change and provided an additional report containing [**redacted**]. This change also affected all subsequent [**redacted**] reports generated by CFNOC and provided to CFNCIU on a periodic basis.

In [**redacted**] CFNCIU requested from CFNOC [**redacted**]. They also requested [**contains information related to DND/CAF operations**].

In [**redacted**] DIMEI 3-5 prodived a report to the CFNCIU containing [**redacted**]. The search criteria used was more than the [**redacted**] previously identified by CFNCIU. DIMEI 3-5 also state that: “If there is an [**contains information related to DND/CAF operations**]

[**redacted**] Activity

In [**redacted**] CFNCIU requested CFNOC with a search of [**redacted**] CFNOC performed the search and provided the results, which included [**redacted**]. This additional request appears to have expanded the search criteria for all subsequent [**redacted**] activity reports. The new search criteria now included  activity from any user where the device matched one previously used by the Subject of investigation.

[**redacted**]

In [**redacted**] CFNCIU requested from DIMEI 3-5 Security Information and Event Management (SIEM) data from [**contains information related to DND/CAF operations**]. SIEM data includes [**redacted**] DIMEI 3-5 later confirmed that [**redacted**].

On [**redacted**] CFNCIU requested from DIMEUS IT inquiries for [**contains information related to DND/CAF operations**] as well as any [**redacted**]. A few days later, DIMEUS shared with CFNCIU that they “are seeing [**redacted**].

In [**redacted**] DIMEI 3-5 internally discuss a pending CFNCIU request for “identify [**redacted**]. They further indicate that this is possible by [**redacted**]. At this point, it is unclear why the scope of the investigation includes more than the [**redacted**]. In a subsequent correspondence, DIMEI 3-5 defined the exact search criteria used to response to the 20 “IT Inquiry” questions. It included the [**redacted**] identified by CFNCIU has having been [**redacted**].

In [**redacted**] CFNCIU provided a list of [**redacted**] to CFNOC. The list of [**contains information related to DND/CAF operations**]. This list was provided alongside a request to CFNOC [**redacted**].

In [**redacted**] CFNCIU requested from DIMEUS a search of [**contains information related to DND/CAF operations**]. One month later, DIMEUS replied with a report containing [**redacted**]. Of the [**redacted**].

Annex A: Findings and Recommendation

Finding 1: NSIRA found that CFNCIU is inappropriately relying on DND/CAF policies as lawful authority to interfere with a Subject’s reasonable expectation of privacy.

Finding 2: NSIRA found that the DND/CAF checklist applied as a standard investigative operating procedure risks capturing information that is protected by s. 8 of the Charter.

Finding 3: NSIRA found that DND/CAF is applying a definition of metadata that captures information that could be subject to a reasonable expectation of privacy.

Finding 4: NSIRA found that CFNCIU risks breaching protected privacy interests by not having clear policy guidance based on lawful authority for IT searches, and by expanding IT searches beyond the approved search parameters.

Finding 5: NSIRA found that the investigative IT system practices it observed in the context CFNCIU’s CI investigations contradict the Office of the JAG and the Department of Justice’s legal advice, [**contains information protected by solicitor-client privilege**].

Recommendation 1: NSIRA recommends that DND/CAF suspend investigative IT system practices in the context of CFNCIU CI investigations until a reasonable legal authority has been established.

Recommendation 2: Once a reasonable legal authority has been established DND/CAF should create a new policy framework that is reflective of the noted findings, namely, the multi-point checklist, the categorization of metadata, the expansion of IT searches and the principle that these searches be as minimally invasive as possible.

Annex B: List of Acronyms

  ADM(IM)  Assistant Deputy Minister Information Management
  CDS  Chief of the Defence Staff
  CF INT GP  Canadian Forces Intelligence Group
  CFINTCOM  Canadian Forces Intelligence Command
  CFIOG  Canadian Forces Information Operations Group
  CFIOG JAG  Canadian Forces Information Operations Group Judge Advocate General
  DND/CF Legal Advisor  Office of the Department of National Defence and Canadian Forces Legal Advisor
  CFNCIU  Canadian Forces National Counter-Intelligence Unit
  CFNIS  Canadian Forces National Investigation Service
  CFNOC  Canadian Forces Network Operations Center
  CI  Counter-intelligence
  CIOC  Counter-Intelligence Oversight Committee
  DAOD  Defence Administrative Orders and Directives
  DGDS/ DPSIM  Director General Defence Security, the Director Personal Security and Identification Management
  DIMEI  Directorate of Information Management Engineering and Integration
  DIMEUS  Department of Information Management End-User Services
  Cabinet du JAG  Cabinet du Juge-avocat général
  CEMD  Chef d’état-major de la défense
  CI  contre-ingérence
  CJ du MDN/FAC  Bureau du Conseiller juridique du ministère de la Défense et des Forces canadiennes
  COMRENSFC  Commandement du renseignement des Forces canadiennes
  CONS JUR  Bureau du conseiller juridique auprès du ministère de la Défense nationale et des Forces canadiennes
  CORFC  Centre d’opérations des réseaux des Forces canadiennes
  CSCI  Comité de surveillance de la contre‑ingérence
  DGSD/DSPGI  directeur général – Sécurité de la défense, Directeur – Sécurité du personnel et gestion de l’identité
  DIIGI  Direction – Ingénierie et intégration (Gestion de l’information)
  DJ/R et OI  directeur juridique/Renseignement et opérations d’information
  DOAD  Directives et ordonnances administratives de la défense
  DSUFGI  Direction – Services à l’utilisateur final (Gestion de l’information)
  GOIFC  Groupe des opérations d’information des Forces canadiennes
  GP RENS FC  Groupe du renseignement des Forces canadiennes
  INTREP  compte rendu de renseignement (Intelligence Report)

Annex C: CFINTCOM Directive

[**redacted letter**]

Annex D: 20-Point Checklist

[**redacted checklist**]

Annex E: [**redacted**]

Annex F: IT Systems Matrix

The table below highlights the networks within the DND/CAF IM/IT infrastructure as well as the areas of responsibility for each group described above.

[**redacted table**]


Share this page
Date Modified:

Review of Information Sharing Across Aspects of CSE’s Mandate

Date of Publishing:

GAC Minister letter to NSIRA To Follow

This report has been modified slightly from the final version which was provided to the Minister. An error in the language of Finding 4, wherein two different versions were presented within the report and the summary, has been corrected for publication. The correct language was always represented in the body of the final report. The incorrect language has been replaced with the correct language for publication.

Executive Summary

(U) This review examined the Communications Security Establishment’s (CSE) legal authority for sharing information obtained in the course of one aspect of its mandate (“aspect”) for the purposes of fulfilling another aspect of its mandate. Specifically, the review focused on internal information sharing within CSE between the foreign intelligence (FI), and the cybersecurity and information assurance (cybersecurity) aspects of its mandate.

(U) NSIRA examined whether CSE’s internal sharing of information relating to a Canadian or a person in Canada (IRTC) is consistent with the Privacy Act, which limits how collected personal information can be used by a federal institution, and the CSE Act, which applies to CSE’s incidental collection and use of IRTC. NSIRA concluded that from the descriptions of the aspects in sections 16 and 17 of the CSE Act, there may be instances where information acquired under one aspect can be used for the same, or a consistent purpose, as another. This would satisfy Privacy Act requirements for sharing information internally. However, this cannot simply be assumed as the purposes of the aspects differ within the CSE Act. CSE must conduct case-by- case compliance analysis that considers the purpose of the collection and sharing.

(U) NSIRA considers it necessary for the Chief of CSE’s application for a Ministerial Authorization to fully inform the Minister of how IRTC might be used and analysed by CSE, including the sharing of IRTC to another aspect, and for what purpose. With one exception, the Chief’s applications for the period of review appropriately informed the Minister of National Defence that retained IRTC might be used to support a different aspect. Moreover, the foreign intelligence applications appropriately informed the Minister how CSE assessed “essentiality” for IRTC collected under the FI aspect.

(U) Under CSE policy, an assessment of IRTC’s relevance, essentiality, or necessity to each aspect is required for sharing information across the aspects. CSE policy offers definitions and criteria for assessing and applying these thresholds to the information. NSIRA found that CSE’s policy framework with regards to the internal sharing of information between the foreign intelligence and cybersecurity aspects of the mandate is compliant with the CSE Act.

(U) The information provided by CSE has not been independently verified by NSIRA. Work is underway to establish effective policies and best practices for the independent verification of various kinds of information, in keeping with NSIRA’s commitment to a ‘trust but verify’ approach.

Authorities

(U) This review was conducted under the authority of paragraph 8(1)(a) of the National Security and Intelligence Review Agency Act (NSIRA Act).

Introduction

(U) This review examined the Communications Security Establishment’s (CSE) legal authority for sharing information obtained in the course of one aspect of its mandate (“aspect”) for the purposes of fulfilling another aspect of its mandate. Specifically, the review focused on internal information sharing within CSE between the foreign intelligence (FI), and the cybersecurity and information assurance (cybersecurity) aspects of its mandate. Broadly, this review also documented activities pertaining to the internal sharing of information relating to a Canadian or a person in Canada between the foreign intelligence and cybersecurity aspects, in order to inform future reviews by NSIRA.

(TS) The Office of the Communications Security Establishment Commissioner (OCSEC) previously studied the sharing of, and access to, cyber threat information between CSE’s SIGINT and IT Security Branches. OCSEC’s review found that CSE’s cyber threat information sharing and accessing activities between CSE’s SIGINT and IT Security were consistent with National Defence Act and Privacy Act authorities, and that information shared between the branches posed a minimal risk to the privacy of Canadians.

(U) With the coming into force of the CSE Act, on August 1, 2019, CSE’s legal authorities for conducting its activities have changed since OCSEC’s review. In light of this change of legal authority for CSE, NSIRA decided to re-assess and evaluate whether CSE’s internal information sharing activities between the FI and cybersecurity aspects are consistent with the CSE Act and the Privacy Act.

(U) NSIRA expects that CSE’s internal sharing of IRTC complies with the CSE Act and the Privacy Act. As such, the focus of this review was to examine the legal authority that allows for CSE to share IRTC between the FI and cybersecurity aspects.

(U) The Communications Security Establishment Act (CSE Act), creates five distinct aspects to CSE’s mandate. The CSE Act distinguishes between each aspect and its associated activities, as listed below: Foreign intelligence (FI) (section 16): to acquire information from the global information infrastructure (GII), and to use, analyse and disseminate the information for the purpose of providing foreign intelligence;

  • Foreign intelligence (FI) (section 16): to acquire information from the global information infrastructure (GII), and to use, analyse and disseminate the information for the purpose of providing foreign intelligence;
  • Cybersecurity and information assurance (cybersecurity) (section 17): to provide advice, guidance and services to help protect electronic information and information infrastructures of federal institutions or those designated under subsection 21(1) of the CSE Act, and to acquire, use and analyse information to do so;
  • Defensive cyber operations (section 18): to carry out activities on the GII to help protect electronic information and information infrastructures of federal institutions or those designated under subsection 21(1) of the CSE Act;
  • Active cyber operations (section 19): to carry out activities on the GII to degrade, disrupt, influence, respond to or interfere with the capabilities, intentions or activities of foreign entities; and
  • Technical and operational assistance (section 20): to provide technical and operational assistance to federal law enforcement, security agencies, the Canadian Armed Forces and the Department of National Defence.

(U) The CSE Act also distinguishes between the aspects by requiring different Ministerial Authorizations (MAs) for CSE’s activities, except for assistance activities (s. 20). Under the CSE Act, and with the exception of assistance activities, CSE’s activities must not be directed at a Canadian or any person in Canada, and must not infringe the Canadian Charter of Rights and Freedoms. Under the FI and cybersecurity aspects, CSE’s activities must not contravene any other Act of Parliament or involve the acquisition of information on or through the GII that interferes with the reasonable expectation of privacy of a Canadian or a person in Canada, unless carried out under a MA.

(U) The Minister of National Defence may issue a MA that permits CSE to conduct activities or classes of activities that may contravene any other Acts of Parliament, and, in the case of FI and cybersecurity, would involve the acquisition of information that would interfere with the reasonable expectation of privacy of a Canadian or a person in Canada. FI and cybersecurity MAs must be approved by the Intelligence Commissioner (IC), who must review whether the conclusions made by the Minister in issuing the authorization are reasonable.

(U) Thus, CSE is permitted to incidentally acquire information relating to a Canadian or a person in Canada in the course of carrying out activities that are authorized by an FI (s. 26(1)), cybersecurity (s. 27(1) or 27(2)), or emergency (s. 40) MA. CSE refers to this information as information relating to a Canadian or a person in Canada (IRTC). In order to issue an authorization, the Minister must be satisfied that CSE will only use, analyse or retain IRTC when it meets the “essentiality” conditions in section 34 of the CSE Act, which are different for the FI and cybersecurity aspects. For FI, “essentiality” means an assessment of whether the information is essential to international affairs, defence or security. For cybersecurity, “essentiality” means an assessment of whether the information is essential to identify, isolate, prevent or mitigate harm to (i) federal institutions’ electronic information or information infrastructures, or (ii) electronic information or information infrastructures designated under subsection 21(1) of the CSE Act.

(U) As the CSE Act distinguishes between the aspects and the corresponding MAs, NSIRA examined CSE’s legal authority for sharing IRTC between the FI and cybersecurity aspects.

(U) Due to operational and access-related challenges, including due to the COVID-19 pandemic, this review was not able to independently assess and verify CSE’s compliance with the law or compliance with the restrictions and authorities in place when internally sharing and using information between aspects. Additionally, NSIRA was not able to independently observe, investigate or validate the systems used when sharing data between aspects (consult Annex F for a description of processes and methods used by CSE to share information between the two aspects). These data sharing systems may be examined in future NSIRA reviews.

(U) NSIRA also intended to review the internal sharing of information with the active (ACO) and defensive (DCO) cyber operations aspects of CSE’s mandate, including compliance with the requirements in subsection 34(4) of the CSE Act on acquiring information while conducting ACO and DCO cyber operations. Among other things, this subsection stipulates that no information may be acquired pursuant to ACO and DCO authorizations unless done in accordance with an FI (CSE Act, s. 26(1)), cybersecurity (CSE Act, ss. 27(1) & 27(2)), or emergency (CSE Act, s. 40(1)) authorization. This facet of the review was instead covered in NSIRA’s review of CSE’s Active Cyber Operations and Defensive Cyber Operations – Governance, and will be further examined in NSIRA’s second review of ACO and DCO activities later in 2021.

(U) Importantly, this review did not examine the disclosure of Canadian identifying information (CII) outside of CSE.

Background

What is IRTC?

(U) While the CSE Act mentions IRTC several times, it is not clearly defined. In practice, IRTC is the information about Canadians or persons in Canada that may be incidentally collected by CSE while conducting FI or cybersecurity activities under the authority of an MA. According to CSE policy, IRTC is any information recognized as having reference to a Canadian or person in Canada, regardless of whether that information could be used to identify that Canadian or person in Canada.

(U) There is a distinction to be made between IRTC and Canadian identifying information (CII). For example, the CSE Act uses both IRTC and CII throughout the Act to describe types of information. Where IRTC is any information recognized as having reference to a Canadian or a person in Canada, CII is information that could be used to identify a Canadian or a person in Canada and that has been used, analyzed or retained under a FI or emergency authorization. CSE describes CII as a subset of IRTC. CII may be disclosed by CSE to designated persons under section 43 of the CSE Act.

Internal Sharing of IRTC at CSE

(TS) In some circumstances, CSE policy allows for IRTC collected under the authority of one aspect to be shared for use under another aspect (see Annex D for a description of the other types of information that is shared between the FI and cybersecurity aspects). CSE policy permits FI to be used internally to fulfill cybersecurity requirements. Information retained under the cybersecurity aspect may be used by CSE personnel operating under the FI aspect, unless the information is subject to any conditions imposed on it by external clients or disclosing entities. According to CSE, sharing information across aspects of the mandate enables CSE to carry out its activities in support of Government of Canada priorities.

(TS) In the cybersecurity context, CSE explained that any IRTC shared internally in support of the FI aspect [redacted description of CSE operations]

(TS//SI) An example that CSE provided [redacted example of CSE operations]. Sharing this information across the aspects of the mandate enabled CSE to help protect GC information and information infrastructures as well as those of Systems of Importance (SOI), by identifying, isolating and mitigating the threat, and provided GC decision- makers with a comprehensive view of the foreign threats targeting Canada.

(TS) After reviewing a random selection of reports, in addition to receiving information by CSE and interviewing analysts familiar with working on both FI and cybersecurity, NSIRA learned that the IRTC shared between the FI and cybersecurity aspects generally included: [redacted list of operational utilized in the system]. CSE policy permits [redacted].

(U) CSE asserts that although IRTC is shared across the aspects, activities will not be directed at Canadians or persons in Canada. As previously mentioned, CSE must not direct its activities at a Canadian or any person in Canada.

Findings and recommendations

Compliance with the CSE Act and the Privacy Act

What Acts Apply to the Internal Sharing of Information?

(S) The relevant statutes that apply to CSE’s internal information sharing are CSE’s enabling statute, the CSE Act, and the Privacy Act. The CSE Act does not provide a clear authority to share IRTC between the aspects. Likewise, the CSE Act disclosure provisions for CII in sections 43–45 do not prima facie contemplate internal sharing of IRTC, as to disclose information under these provisions, the Minister would need to authorize CSE to collect and disclose CII to itself. Additionally, CSE is not a designated entity under section 45 of the CSE Act for the purposes of receiving disclosed information under sections 43 and 44.

(U) IRTC could constitute personal information as defined in section 3 of the Privacy Act, which is information about an identifiable individual that is recorded in any form. For example, Canadian IP addresses, may constitute both IRTC for the purposes of the CSE Act and personal information under the Privacy Act. Pursuant to section 4 of the Privacy Act, the collection of personal information must relate directly to an operating program or activity of the institution, which includes CSE’s mandated activities in the CSE Act.

(U) The Privacy Act also requires that personal information be used and disclosed in manner consistent with sections 7 and 8 of the Privacy Act. For reference, Section 7 of the Privacy Act states:

Personal information under the control of a government institution shall not, without the consent of the individual to whom it relates, be used by the institution except

  • For the purpose for which the information was obtained or compiled by the institution or for a use consistent with that purpose; or
  • For a purpose for which the information may be disclosed to the institution under subsection 8(2).

(U) NSIRA examined whether CSE’s internal sharing of IRTC is consistent with the Privacy Act, which limits how collected personal information can be used by a federal institution. NSIRA concluded that in some circumstances, as described later in the report, internal sharing of IRTC that constitutes personal information between the FI and cybersecurity aspects might satisfy Privacy Act requirements. This compliance assessment requires a case-by-case analysis.

(Protected B//Solicitor-Client Privilege) NSIRA examined CSE DLS’s legal analysis, provided by Department of Justice (DOJ) lawyers, [redacted legal opinion or advice].

(Protected B//Solicitor-Client Privilege) In DOJ’s opinion, [redacted legal opinion or advice].

(Protected B//Solicitor-Client Privilege) According to DOJ, [redacted legal opinion or advice].

Compliance with the Privacy Act

(U) NSIRA observes that, in assessing compliance with section 7 of the Privacy Act, CSE emphasizes compliance with paragraphs 34(2)(c) and 34(3)(d) of the CSE Act to support the internal sharing of personal information across the various aspects of the mandate.

(U) As noted, section 7 of the Privacy Act requires that personal information under the control of a government institution shall not be used without the consent of an individual, except for two purposes: (1) the purpose for which it was obtained, or for a use consistent with that purpose; or (2) for a purpose for which the information may be disclosed to the institution under subsection 8(2) of the Act. Importantly, a use of information need not be identical to the purpose for which information was obtained; it must only be consistent with that purpose.

(U) CSE’s reliance on section 34 of the CSE Act poses a challenge for compliance with the Privacy Act because section 34 does not identify the actual purpose of the incidental collection of the IRTC, or provide an authority for internal sharing. Rather, section 34 conditions the Minister’s authority to issue an MA on prerequisites. Paragraphs 34(2)(c) and 34(3)(d) of the CSE Act specify that the Minister must be satisfied that the privacy protection measures in section 24 of the Act will ensure that IRTC will be used, analysed, and retained only if it complies with the respective essentiality requirements for FI and cybersecurity, as the case may be. These conditions establish a required threshold for the use, analysis and retention of IRTC collected under a MA, and not an authority for internal sharing of IRTC.

(U) Depending on the factual circumstances in which the IRTC is shared, CSE’s sharing of IRTC that constitutes personal information between the FI and cybersecurity aspects could be supported by the CSE Act and the Privacy Act when the information is shared for the purpose for which it was obtained, or for a use consistent with that purpose. This would require a case-by- case assessment to ensure that the purpose for which the IRTC is shared internally is for the same purpose for which it was collected, a purpose consistent with that original purpose for collection, or as permitted by section 7(b), that the sharing is permitted for one of the reasons identified by Parliament in subsection 8(2) of the Privacy Act. As mentioned, CSE does not consider internal sharing a disclosure of information. NSIRA notes that the issue of whether internal sharing in this way constitutes a “use” or a “disclosure”, under the Privacy Act is unclear. Regardless, NSIRA observes that in relying solely on the “essentiality” criteria in section 34, CSE is not assuring itself that it has lawful authority for internal sharing.

(U) A justification under section 7(a) or paragraph 8(2)(a) of the Privacy Act requires CSE to identify the purpose of the incidental collection and internal sharing, which is found in the corresponding aspect of CSE’s mandate. CSE’s purpose for collecting, and authority to collect, personal information comes from the CSE Act. Sections 16 and 17 of the Act identify FI and cybersecurity as operating programs and activities of the institution, and provide the authority to collect information for those purposes. As noted, MAs must authorize collection when activities might contravene any other Act of Parliament, or involve the acquisition of information from or through the GII that interferes with a reasonable expectation of privacy of a Canadian or a person in Canada. From the descriptions of the aspects in sections 16 and 17 of the CSE Act, there may be instances where information acquired under one aspect can be used for the same, or a consistent purpose, as exists for another, thus satisfying Privacy Act requirements for sharing information internally. However, this cannot simply be assumed as the purposes of the aspects are described differently within the Act.

(U) Section 16 of the CSE Act authorizes CSE to acquire information from or through the GII, and to use, analyse and disseminate the information for the purpose of providing foreign intelligence in accordance with Government of Canada (GC) priorities. Section 17 of the CSE Act, in turn, authorizes CSE to provide advice, guidance and services to help protect the electronic information or information infrastructures of federal institutions and designated systems of importance, and to acquire, use and analyse information, from the GII or from other sources, in order to provide such advice, guidance and services.

(TS//SI) When sharing FI-acquired IRTC to support CSE’s cybersecurity aspect, there is arguably no shift in purpose if cybersecurity is among the purposes for which the FI is obtained, used, analysed and disseminated. For the period of this review, [redacted related to GC priorities]. Sharing FI information to fulfill CSE’s section 17 cybersecurity objectives of providing advice, guidance and services to help protect federal and designated electronic information and infrastructures could be considered as the same purpose, or consistent with the purpose, for which the IRTC was originally obtained. Where the FI is used in the section 17 aspect to protect federal and designated electronic information and infrastructures, the purpose of collection and the subsequent use of that information could remain the same.

(U) For cybersecurity-acquired IRTC, sharing information to the FI aspect could be permissible if the FI purpose is the same as, or consistent with, the purpose for which the information was initially acquired, i.e., for the purpose of providing advice, guidance and services to help protect federal and designated information infrastructures or electronic information. Thus, sharing cybersecurity IRTC to the FI aspect would be permissible under the Privacy Act if the internal sharing ultimately serves the purpose of helping to protect federal and designated information infrastructures or electronic information.

(U) In sum, if the purpose of CSE’s acquisition of personal information is for the purpose of, or consistent with, delivering on the foreign intelligence and/or cybersecurity aspects, CSE’s internal sharing of IRTC can be consistent with section 7(a) or paragraph 8(2)(a) of the Privacy Act, provided that purpose of the information collection and sharing is identified and justified. CSE must also always satisfy any conditions from the CSE Act and relevant MAs on the collection and use of IRTC. To support internal sharing of personal information between the aspects, further analysis is required based on the factual circumstances of each case.

Finding no. 1: CSE’s internal sharing of information between the FI and cybersecurity aspects of the mandate has not been sufficiently examined for compliance with the Privacy Act.

Recommendation no. 1: CSE should obtain additional legal advice on its internal sharing of information between the foreign intelligence and cybersecurity aspects of the mandate, explicitly in relation to compliance with the Privacy Act, which thoroughly addresses the following two issues:

  1. Whether the internal sharing of information between the foreign intelligence and cybersecurity aspects of the mandate is a use or a disclosure of information for the purposes of the Privacy Act; and
  2. Whether uses and disclosures are done in accordance with sections 7 and 8 of the Privacy Act.

The Ministerial Authorizations

(U) The CSE Act does not allow the Minister to authorize internal sharing of IRTC, as MAs may only authorize, in the case of FI, the activities or classes of activities listed in subsection 26(2), or for cybersecurity, access and acquisition of the information referred to in subsections 27(1) and 27(2). Any internal sharing of IRTC that constitutes personal information must be done in accordance with the Privacy Act.

(U) As mentioned, section 24 of the CSE Act requires CSE to have measures in place to protect the privacy of Canadians and of persons in Canada in the use, analysis, retention and disclosure of IRTC. When issuing a MA, the Minister must conclude that these measures will ensure that any acquired IRTC will only be used, analysed or retained if it meets the essentiality thresholds in paragraphs 34(2)(c) or 34(3)(d). The Minister may issue these authorizations if they are of the view that such activities would be “reasonable and proportionate, having regard to the nature of the objective to be achieved and the nature of the activities.” As the Minister considers the reasonableness of the activities proposed against either an FI or cybersecurity purpose, it is conceivable that some activities might be reasonable and proportionate in one context, but not in the other. As activities authorized under subsection 26(2) might acquire a broader range of information than what is contemplated in subsections 27(1) and 27(2), the sharing of FI to cybersecurity might allow for CSE to use more information for a cybersecurity purpose than what is permitted under cybersecurity authorizations alone, and may require different privacy protection measures when using such information.

(U) To issue an MA, the Chief of CSE must set out the facts in an application that would allow the Minister to conclude that there are reasonable grounds to believe that the authorization is necessary, and that the conditions for issuing it are met. NSIRA considers it necessary for the Chief’s application to fully inform the Minister of how IRTC might be used and analysed by CSE, including the sharing of IRTC to another aspect, and for what purpose. This information would also allow for the Minister to make a determination under section 35 whether any other terms, conditions, or restrictions are advisable to protect the privacy of Canadians when issuing a FI or cybersecurity authorization.

(TS//SI) For the authorizations issued during 2020, most of the Chief of CSE’s applications indicated that collected and retained information might be used under a different aspect, while the text of most of the corresponding MAs did not mention use under a different aspect. This situation was reversed in one instance: [redacted example of CSE operations].

(TS//SI) Moreover, the 2020 FI applications and authorizations indicate that in order to meet the essentiality condition for retention of IRTC under subsection 34(2)(c) of the CSE Act, IRTC will be retained if it is assessed as essential to cybersecurity. In these instances, cybersecurity is included under the concept of “essential to security”, thus providing the Minister with additional context as to how the essentiality conditions are assessed and met by CSE. NSIRA considers this information necessary for the Minister to assess whether the conditions listed in section 34 of the CSE Act for issuing the authorization are met.

Finding no. 2: With one exception, the Chief of CSE’s applications for Ministerial Authorizations issued in 2020 informed the Minister of National Defence that retained information might be used to support a different aspect.

Finding no. 3: The applications for foreign intelligence authorizations by the Chief of CSE for the period of review appropriately informed the Minister of National Defence how the essentiality condition in paragraph 34(2)(c) is met for IRTC collected under the FI aspect.

Recommendation no. 2: All foreign intelligence and cybersecurity applications from the Chief of CSE should appropriately inform the Minister of National Defence that retained information might be used to support a different aspect.

Assessment of Essentiality, Necessity, and Relevancy

(U) Under CSE policy, an assessment of IRTC’s relevance, essentiality, or necessity to each aspect is required for sharing information across the aspects (see Annex G for CSE’s policy thresholds and definitions used to assess IRTC when shared between the aspects). These terms come from the CSE Act, but are not defined in the Act. CSE policy offers definitions and criteria for assessing and applying these thresholds to the information. NSIRA did not assess these policy thresholds or definitions for lawfulness, or how these requirements are satisfied by CSE when internally sharing IRTC. This may be examined in future reviews.

(TS) CSE policy also sets forth the criteria by which to authorize the sharing of IRTC across aspects (see Annex E for the approval processes at CSE for sharing information). Before any IRTC may be shared across aspects of the mandate, the information must be assessed for essentiality to the aspect for which it was acquired. If it does not pass this initial essentiality threshold, the information must be deleted.

(Protected B//Solicitor-Client Privilege) According to CSE, [redacted legal opinion or advice]

(U) NSIRA agrees that the CSE Act does not require that internally shared IRTC between the FI and cybersecurity aspects meet both of the essentiality conditions of paragraphs 34(2)(c) and 34(3)(d) of the CSE Act. Subsections 22(3) and 22(4) of the CSE Act require an FI or cybersecurity MA when the activities carried out in furtherance of either aspect involve acquiring information from the GII that may interfere with a reasonable expectation of privacy, or for activities that might contravene an Act of Parliament. MAs may only authorize the activities or classes of activities listed in subsection 26(2) for FI, or to access information infrastructures and acquire the information referred to in subsections 27(1) and 27(2). As mentioned, the “essentiality” thresholds in section 34 condition the Minister’s authority to issue an MA on the prerequisite of the privacy protection measures in section 24. Such a requirement can be understood as applying to use, analysis and retention of IRTC collected by CSE under the authority of a MA and within the confines of a single aspect. Therefore, there is no legal requirement within the CSE Act that CSE observe the essentiality threshold of the aspect of which the IRTC is internally shared. IRTC must only meet the original essentiality condition of either paragraph 34(2)(c) or 34(3)(d) when IRTC is acquired, as required by the MA authorizing its actual incidental collection.

Finding no. 4: CSE’s position that they do not need to assess “essentiality” twice when sharing information between the foreign intelligence and cybersecurity aspects of the mandate is compliant with paragraphs 34(2)(c) and 34(3)(d) of the CSE Act.

Conclusion

(U) As the CSE Act distinguishes between the aspects and the corresponding MAs, NSIRA examined CSE’s legal authority for sharing IRTC between the FI and cybersecurity aspects of its mandate. NSIRA concludes that internal sharing may be consistent with the Privacy Act in some circumstances. However, CSE must give further consideration to the purpose of the collection of the IRTC to justify any internal sharing of IRTC.

(U) This review also established a foundational understanding of some of the processes, systems, and compliance measures applied by CSE when sharing IRTC across aspects. Although NSIRA was not able to independently verify this information, NSIRA intends to build upon this information in future reviews.

Annexes

ANNEX A: Objectives, Scope, and Methodology

(U) Initially, NSIRA intended to examine the internal sharing of IRTC between aspects of CSE’s mandate in a thematic manner that covered several operational areas and several aspects. The review intended to examine the sharing of information between aspects of CSE’s mandate for the period of August 1, 2019 to August 1, 2020, with the objective to independently assess and evaluate:

  • Compliance with legal, ministerial, and policy requirements, including adequate management of compliance risks when conducting information sharing activities between aspects of CSE’s mandate; and,
  • CSE’s policies, procedures and practices on the internal sharing of information between aspects of the mandate.

(U) Due to operational realities, including COVID-19 related disruptions and access challenges, the objectives, scope, and methodology of this review were significantly reduced from the original Terms of Reference (sent to CSE on August 28, 2020), to focus mainly on the legal authority for sharing of information between the FI and cybersecurity aspects.

(U) For this review, NSIRA examined documents and records relevant to the sharing of information between aspects of CSE’s mandate, from the coming into force of the CSE Act on August 1, 2019, until August 1, 2020.

(U) Two interviews were conducted with CSE employees involved with information sharing across CSE’s aspects, and an interview was conducted with a Department of Justice lawyer in CSE’s Directorate of Legal Services familiar with the legal framework of such activities.

(U) NSIRA also completed a foundational description of some of the processes, systems, and compliance measures in place when sharing such information, in order to establish a baseline of knowledge to inform future reviews.

ANNEX B: Meetings and Briefings

Briefing. “Information Sharing: Sharing information for use across aspects of the CSE Mandate”, NSIRA Briefing, February 7, 2020.

NSIRA meeting with counsel from the Department of Justice at CSE DLS, October 13, 2020.

NSIRA meeting with CSE analysts, October 20, 2020.

ANNEX C: Findings and Recommendations

Finding no. 1: CSE’s internal sharing of information between the FI and cybersecurity aspects of the mandate has not been sufficiently examined for compliance with the Privacy Act.

Recommendation no. 1: CSE should obtain additional legal advice on its internal sharing of information between the foreign intelligence and cybersecurity aspects of the mandate, explicitly in relation to compliance with the Privacy Act, which thoroughly addresses the following two issues:

  • Whether the internal sharing of information between the foreign intelligence and cybersecurity aspects of the mandate is a use or a disclosure of information for the purposes of the Privacy Act; and
  • Whether uses and disclosures are done in accordance with sections 7 and 8 of the Privacy Act.

Finding no. 2: With one exception, the Chief of CSE’s applications for Ministerial Authorizations issued in 2020 appropriately informed the Minister of National Defence that retained information might be used to support a different aspect.

Finding no. 3: The applications for foreign intelligence authorizations by the Chief of CSE for the period of review appropriately informed the Minister of National Defence how the essentiality condition in paragraph 34(2)(c) is met for IRTC collected under the FI aspect.

Recommendation no. 2: All foreign intelligence and cybersecurity applications from the Chief of CSE should appropriately inform the Minister of National Defence that retained information might be used to support a different aspect.

Finding no. 4: CSE’s position that they do not need to assess “essentiality” twice when sharing information between the foreign intelligence and cybersecurity aspects of the mandate is compliant with paragraphs 34(2)(c) and 34(3)(d) of the CSE Act.

ANNEX D: Partner and client information and publicly available information shared between the fi and cybersecurity aspects

(Protected B) Under the cybersecurity aspect, federal and non-federal clients may disclose cyber threat information to CSE as Canada’s lead agency for cybersecurity, or when seeking CSE services to analyse and mitigate known or suspected cyber incidents. Disclosed information may be used for FI purposes provided that it is done so for the purposes of identifying, isolating, preventing or mitigating harm to federal systems or systems of importance to the GC.

(Protected B) The documentation that governs CSE’s arrangements with GC and non- federal clients specifies that information obtained by CSE from a given client’s network or system that is relevant to the cybersecurity aspect may be shared with partners [redacted CSE operational information] or internal partners for GC clients) involved in cybersecurity for the purposes of identifying, isolating, preventing or mitigating harm to federal systems or systems of importance to the GC. However, this type of documentation does not explicitly mention that clients’ information might be used for FI purposes. For the purposes of obtaining the informed consent of disclosing entities, NSIRA considers it appropriate for CSE to be fully transparent with how clients’ information might be used by CSE.

(Protected B) When client information is shared with [redacted CSE operational information] partners, the information is anonymized and identifiable information is omitted. Any releasable cybersecurity products created from client information must only contain information necessary to mitigate a cyber compromise. Additionally, disclosing entities may also impose specific restrictions on the use and sharing of their data at the time of disclosure.

(TS) As per subsection 21(1) of the CSE Act, CSE is permitted to acquire and use publicly available information without seeking a MA. Currently, [redacted related to legal opinion or advice].

ANNEX E: Approval Process and Sharing Release Approvals

Approval Processes for Sharing IRTC

(TS//SI) The appropriate approval authority for sharing information is outlined in CSE internal policy, where the nature of the information dictates the release authority. CSE policy requires management approval (known as the release authorities) before sharing unsuppressed IRTC between aspects. However, policy does not stipulate the actual process for approval; this is determined by the relevant operational areas in accordance with their business practices. The Mission Policy Suite (MPS) requires all management decisions to be documented and retained in a central repository for transparency and accountability purposes. Those records must be accessible for review purposes. However, for this review, NSIRA was unable to independently verify and assess the approval process for internally shared IRTC.

(TS) Generally, CSE requires management approval for sharing information contained within a report for use across aspects of the mandate, and will elevate the appropriate release authority when the information contains IRTC. The appropriate release authority and conditions for release are outlined in policy (discussed below). The release authority is responsible for the information exchange, and must be informed if any changes are made to the data that result in a change in the type of privacy-related information to be shared.

(TS) Automated sharing techniques [redacted related to GC priorities].

Cybersecurity IRTC to Foreign Intelligence

(U) Retained IRTC under the cybersecurity aspect can be shared to FI as a Releasable Cybersecurity Product (RCP), which must meet the requirements listed below. The release authority is determined by the privacy impact that the release of information may have on an individual or entity, which is in turn determined by the level of sensitivity and privacy impact of the IRTC. Depending on the level of sensitivity of the IRTC, operational managers or supervisors from the Canadian Centre for Cyber Security (CCCS, or Cyber Centre) must approve RCPs containing IRTC.

(U) The requirements for a RCP as per CSE policy include the following:

Requirement When and How the Requirement is Applied
Purpose is to provide advice, guidance, and services At the time of sharing – why am I sharing this information?
Product only contains retained information The decision to use and retain information is made at the time the raw data is assessed for relevance and necessity (and in the case of IRTC, essentiality) to the cybersecurity aspect of the mandate.
Privacy Protection

At the time of sharing, as appropriate (e.g., being shared back with the system owner/administrator who already has access to the information on their own systems; or to a broader audience with strict limits on the use of the information).

No suppression is required if the IRTC is shared for use under the FI aspect of the mandate when the sharing is for the purposes of supporting activities to help protect the electronic information and information infrastructures of the GC or SOI to the GC

Classification and limitations on use and handling

Either at the time of sharing, or applied at a later stage to the onward use and dissemination of the information by FI. Can include pre-approved uses and conditions, as well as limitations placed by the data/system owner if applicable.

Can be applied by report-authoring platforms to End Product Reports (EPRs), restrict the use and dissemination of CSE information.

Auditable At the time of acquisition, applied automatically by CSE systems.
All data entering CSE is automatically tagged with a unique identifier, as well as information regarding origin (e.g., MA vs non-MA, disclosing client if applicable etc.), access restrictions if applicable, aspect of the mandate under which the data was acquired, date and time of acquisition, use and handling requirements.
Approved for release

At the time of sharing.

The approval authority depends on the nature of the information. See table in s. 25.2 in the MPS cybersecurity chapter.

Foreign Intelligence IRTC to Cybersecurity

(TS) IRTC under the FI aspect can be released to CCCS as a Releasable SIGINT Product (RSP). RSPs that contain information with a recognized Canadian privacy interest, or based on material with a Canadian privacy interest, require DC SIGINT approval for release, which can be delegated.

(TS) In order to create a RSP to share information for use under the cybersecurity aspect, the following table summarizes how the criteria required in policy must be met:

Requirement When and How the Requirement is Applied
Information is relevant to FI At the time of assessment. Must be met prior to use.
Privacy protection e.g., suppression of IRTC

At the time of sharing, if necessary.

Suppression is mandatory for IRTC included in an EPR shared outside CSE. CCCS clients that receive these EPRs may request this CII through the regular Action-On process.

Otherwise, no suppression required if IRTC is necessary for cybersecurity purposes, but other measures to protect privacy are used, for example, restricting the audience for the information.

Sanitization Either at the time of sharing, or to be applied if/when cybersecurity use requires the information be sanitized to protect CSE equities.
Serialization

At the time of acquisition, applied automatically by CSE systems.

All data entering CSE is automatically tagged with a unique identifier, as well as information regarding origin [redacted example of CSE operations] access restrictions if applicable, aspect of the mandate under which the data was acquired, date and time of acquisition, use and handling requirements.

Caveats

Either at the time of sharing, or applied at a later stage to the onward use and dissemination of the information by cybersecurity. Can include pre- approved actions-on.

Automatically applied by report-authoring platforms to EPRs, limit the use and dissemination of CSE information.

Approved for release

At the time of sharing.

The approval authority depends on the nature of the information. See table in s. 27.8 of MPS FI chapter.

Internal Reviews of Information Sharing

(TS) Internal sharing of information between the aspects is subject to CSE internal review, for both automated sharing and data-based queries. SIGINT Compliance, the group responsible for internal compliance activities under the FI aspect, reviewed CSE-originated queries for 2019 and 2020, and found that query activity was complaint. The CCCS’ Internal Program for Operational Compliance (IPOC) did not prioritize compliance monitoring reviews for the past two fiscal years in order to monitor other activities that posed a higher-risk to compliance.

(TS) Automated sharing techniques are also subject to review. SIGINT Compliance is required to revalidate all instances of automated sharing between the FI and cybersecurity aspects every 12 months. The most recent review for the period of July 2019 to September 2020 found that the [redacted number] of automated sharing were compliant with policy requirements, except for [redacted number] that CSE was unable to assess.

ANNEX F: Methods and processes of sharing

(TS) This section describes the methods and processes used by CSE to share information between the FI and cybersecurity aspects. There is a multitude of systems, methods, and processes that enable information sharing between these aspects, both suppressed and unsuppressed. Note that the processes described below are not static, and that CSE’s systems, methods, and processes can change anytime.

(TS) Generally, access to information for each aspect is restricted by [redacted related to legal opinion or advice]

(TS//SI) For examples, [redacted description of CSE operations].

(U) As required by section 24 of the CSE Act, CSE must have measures in place to protect the privacy of Canadians and persons in Canada in the use of information related to them acquired in furtherance of the FI or cybersecurity aspects.

(TS) Suppression and minimization of IRTC is not required by CSE policy when sharing information internally; it is a default practice to share IRTC unsuppressed across the FI and cybersecurity aspects. According to CSE, although not mandated by policy, analysts are encouraged to anonymize or remove privacy-related information where it is not essential for the person using the information to understand the context and value. CSE recognizes that suppression and minimization are a best effort practice, and is of the opinion that CSE is not in contravention of the law should suppression, minimization, anonymization not occur when sharing information between the aspects.

Cross-Aspect Access to both SIGINT and Cyber Centre Raw Data

(TS) When accessing data from another aspect that is not within a reporting product (i.e., RSPs or RCPs), analysts are subject to the policy requirements of the data they are accessing.

(TS//SI) Under the FI aspect, [redacted description of CSE operations].

(TS//SI) For examples, [redacted description of CSE].

(TS//SI) While analysing raw FI data, Cyber Centre personnel must follow all applicable foreign intelligence authorities and policy requirements. The use, handling, and retention of this information is further subject to any restrictions applied to the foreign intelligence data.

(TS//SI) SIGINT personnel may access and use Cyber Centre systems if they meet the requirements in section 26.1 of the MPS Cybersecurity. Access to Cyber Centre systems and raw cybersecurity data is similarly restricted [redacted] to individuals with an operational need-to-know and mandatory annual policy and compliance training and knowledge testing. [description of CSE operations].

Reporting – RCPs and RSPs

(U) Retained information is internally shared through formal reporting processes in the form of either RSPs, which includes EPRs, or RCPs.

(TS//SI) Cyber Centre personnel operating under cybersecurity requirements may also be internal clients without access to raw FI data. Foreign intelligence information is shared to some cybersecurity personnel as an RSP, meaning that the information has met the requirements for release in CSE policy, including suppression and approval, and is subject to any restrictions on the intelligence data. For the period of review, there [redacted number] RSPs approved for release from the FI aspect that were made available to personnel operating under the cybersecurity aspect.

(TS//SI) Cybersecurity information can be reported and released to SIGINT personnel for subsequent use under the FI aspect via RCPs. Information released through RCPs must meet the requirements for release within CSE policy, and the use must be consistent with the cybersecurity aspect of CSE’s mandate and used for a subsequent use related to relevant GC priorities. For the period of review, [redacted number] RCPs were disseminated to authorized recipients in SIGINT.

Receiving Suppressed Identifiers from Reporting

(TS) Suppressed IRTC in EPRs disseminated through SLINGSHOT can be requested by internal CSE clients through the existing CII external disclosures process. This is the only mechanism by which suppressed identities can be accessed and released. Supressed IRTC can be requested by submitting a request to the Action-On team (D2A). The requestor must provide the legal authority and operational justification to receive the unsuppressed information. Between August 1, 2019 and August 1, 2020, [redacted description of CSE operations].

(TS) Although the mechanism for releasing this information is the same as the external disclosures process, it is not considered a “disclosure” of information but an internal “use” of information. As such, the disclosure regime requirements of sections 43 to 46 of the CSE Act do not need to be met in order for supressed information to be released to internal CSE clients.

Joint-Reporting

(TS//SI) Information may also be shared between the foreign intelligence and cybersecurity aspects for the purposes of disseminating foreign intelligence under cybersecurity authorities. This foreign intelligence information must first be used for foreign intelligence purposes, and then may be shared to CCCS personnel use under the cybersecurity aspect and only then released under their authorities.

(TS//SI) Approval for sharing of foreign intelligence information under the cybersecurity aspect of the mandate must abide by the appropriate release approval authorities for both aspects.  [redacted description of CSE operations]

Automated Sharing (forms of RSP or RCP)

(TS) Automated sharing is defined in CSE policy as “the use of automated techniques or processes to expedite the dissemination of [redacted releasable reporting products]”.

(TS//SI) There are various automated feeds used at CSE to exchange information between the aspects. [redacted description of CSE operations].

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted]

(TS//SI) [redacted description of CSE operations and systems]

(TS//SI) [redacted description of CSE operations and systems]

Other Methods of Sharing

(TS) More informal methods of information exchange may occur between the two aspects. As CSE teams work closely together, analysts might gain knowledge of information that can be useful for either aspect of the mandate. Analysts may exchange general knowledge without any formal reporting. CSE policy provides for analytic exchanges whereby analysts may engage with partners working under a different aspect to work on common objectives by exchanging information. However, any data exchange must meet the requirements of issuing a RCP or RSP, although the data need not be released through the formal product dissemination systems.

ANNEX G: Policy Thresholds for Internal Sharing

(U) Generally, CSE policy provides that IRTC may be shared internally according to the thresholds outlined below. As mentioned, NSIRA did not assess these thresholds or definitions for lawfulness, but may do so in future reviews. Additionally, NSIRA did not assess how these policy requirements are satisfied in practice.

Foreign Intelligence Aspect to Cybersecurity Aspect

(TS) Under the FI aspect, IRTC must be essential and relevant to the FI aspect prior to sharing, as per the essentiality condition in 34(2)(c) of the CSE Act. According to CSE policy, the information must be considered essential to international affairs, defence or security, including cybersecurity. Essential is not defined in CSE policy, though policy provides criteria by which to assess the IRTC as it relates to protecting the lives or safety of individuals, or to serious criminal activity relating to the security of Canada.

(TS) To share FI IRTC information for use under the cybersecurity aspect of the mandate, the IRTC information must be relevant to the cybersecurity aspect. IRTC must further be assessed for necessity to the cybersecurity aspect, meaning whether the information is necessary to help protect GC systems and designated systems of importance. It is a policy decision to apply the threshold of necessity from subsection 44(1) of the CSE Act.

(TS) CSE policy requires the standard of necessity, [redacted description of CSE operations]. This information is necessary to fulfill the cybersecurity mandate as it enables activities that protect GC systems and designated SOIs (such as by blocking traffic). However, the identifiable individual or entity is not the focus of the activity.104 Therefore, CSE is of the opinion that since there is a lower risk to the reasonable expectation of privacy of the individual in the cybersecurity context, the threshold of necessity is sufficient for sharing FI-acquired IRTC to the cybersecurity aspect.

Cybersecurity Aspect to Foreign Intelligence aspect

(TS//SI) Under the cybersecurity aspect, IRTC acquired under a MA must be both relevant and essential prior to sharing, as per the essentiality condition under paragraph 34(3)(d) of the CSE Act. In CSE policy, IRTC is considered essential when without the information, CSE would be unable to protect federal systems or SOIs and the electronic information on those systems. However, non-MA acquired IRTC, such as client information, must only be necessary.

(TS) The shared IRTC is also assessed for essentiality to the FI aspect (that is, essential to international affairs, defence or security), for both MA and non-MA cybersecurity information. It is a policy decision to further assess cybersecurity-acquired IRTC for essentiality under the FI criteria, [redacted description of CSE operations].

(TS//SI) As explained by CSE, the cybersecurity-acquired IRTC shared internally in support of the FI aspect is for the purposes of protecting federal institutions or SOIs and the electronic information they contain. This IRTC is used to identify foreign threats to Canadian systems, which aligns with the [redacted related to GC priorities].

ANNEX H: Internal Sharing of IRTC at CSE

Figure: Process Diagram of Internal Sharing of IRTC at CSE

Share this page
Date Modified:

Review of Global Affairs Canada’s Global Security Reporting Program

Backgrounder

This review focused on Global Affairs Canada’s (GAC) Global Security Reporting Program (GSRP, or the Program). The review was selected given that the GSRP is a key component to GAC’s security and intelligence footprint overseas, with approximately thirty officers posted around the world dedicated and funded to collect overt security-related information.  GSRP clients have reported that the Program is both unique and valuable to the Government of Canada. This review is the first external review of GSRP and NSIRA’s inaugural review of GAC.

Many of the receiving states where GSRP officers work have poor human rights records and/or are environments where surveillance of foreigners and citizens is commonplace. As such, receiving state perceptions of GSRP activities have direct implications on reputational risk to Canada and its allies, to other Canadian departments and agencies (like the Canadian Security Intelligence Service (CSIS), for example), to GSRP officers, and finally, on the local contacts used to help collect the Program’s information.

The review found a number of areas where the Program can improve, including more robust governance and accountability structures, additional oversight and attention to information management best practices.

Date of Publishing:

GAC Minister letter to NSIRA To Follow

Executive Summary

This review focused on Global Affairs Canada’s (GAC) Global Security Reporting Program (GSRP, or the Program). The review was selected given that the GSRP is a key component to GAC’s security and intelligence footprint overseas, with approximately thirty officers posted around the world dedicated and funded to collect overt security-related information. GSRP clients have reported that the Program is both unique and valuable to the Government of Canada. This review is the first external review of GSRP and NSIRA’s inaugural review of GAC.

Many of the receiving states where GSRP officers work have poor human rights records and/or are environments where surveillance of foreigners and citizens is commonplace. As such, receiving state perceptions of GSRP activities have direct implications on reputational risk to Canada and its allies, to other Canadian departments and agencies (like the Canadian Security Intelligence Service (CSIS), for example), to GSRP officers, and finally, on the local contacts used to help collect the Program’s information.

The review found a number of areas where the Program can improve, including more robust governance and accountability structures, additional oversight and attention to information management best practices.

More significantly, the review found that although the GSRP operates under the Vienna Convention on Diplomatic Relations (VCDR), it does so without legal guidance assessing the activities of the Program. Likewise, GSRP officers do not receive adequate training regarding their legal obligations. In particular, the activities of certain GSRP officers abroad raised concern that some activities may not be in accordance with the duties and functions under the VCDR.

Although GSRP officers rely on the VCDR as a shield for their actions, some officers did not appear to appreciate the limitations of this immunity nor understand the true scope of their duties and functions. In addition, it was not clear if all officers understood that once they are no longer afforded diplomatic immunity, a receiving state may seek retaliatory measures against them. The review found an absence of risk assessments, security protocols, and legal guidance specific to the increased scrutiny that GSRP officers may attract due to the nature of their reporting priorities.

As government partners overseas, CSIS and GSRP frequently interact with each other, with overlap between these respective mandates. Insufficient deconfliction at Mission and Headquarters between CSIS and GAC exists, which results in inconsistent governance [redacted].

The review also found that the Program does not have appropriate safeguards in place regarding the safety of contacts overseas. Although most interactions between officers and contacts are innocuous, the Program does not appear to appreciate the associated risks of these exchanges. Significantly, the review identified some possible concerns related to how recommended that GAC Canadian identity information is managed, and therefore conduct a privacy impact assessment of the Program.

The creation of a foreign intelligence entity within GAC, or the allowance of mission creep by the GSRP into covert collection would run against the principles of the VCDR. Therefore, NSIRA believes it is important that the Government consider the implications stemming from this review and decide on the most appropriate means of collecting this kind of information. NSIRA acknowledges that this is a topic that goes beyond our remit, and therefore may require consideration by the National Security and Intelligence Committee of Parliamentarians. We intend to share this review with our review counterpart in order to commence such deliberations.

Authorities

This review was conducted under the authority of subsections 8(1)(a) and 8(1)(b) of the National Security and Intelligence Review Agency Act.

Introduction

Global Affairs Canada’s (GAC) Global Security Reporting Program (GSRP) collects and disseminates information in support of Canada’s intelligence priorities. As the program has matured during its nearly twenty years of existence, GSRP products have received attention from Government of Canada (GoC) departments and agencies, as well as allied nations.

This was the National Security and Intelligence Review Agency’s (NSIRA) first standalone review of GAC. As such, NSIRA familiarized itself with GAC’s mandate, policies, and legal authorities while simultaneously reviewing the GSRP as a unique and complex program.

NSIRA assessed whether GSRP activities were conducted in accordance with the law, relevant policies and procedures, and whether the activities were reasonable and necessary. Additionally, NSIRA examined whether the Program’s policies and procedures were sufficiently comprehensive to support overseas activities.

The core review period for this study was from January 1, 2017, to December 31, 2019, however, NSIRA reviewed information outside of this period in order to conduct a complete assessment. NSIRA also examined a significant sample of GSRP Missions that provided diverse perspectives on the nature and scope of the Program’s activities.

Given the unique circumstances of NSIRA’s recent establishment and the various logistical and procedural challenges associated with this transition, this review was only possible with the support of GAC staff, especially those within its External Review Liaison Unit. Additionally, NSIRA thanks CSIS and its External Review and Compliance team for its help in facilitating this review. This report was scheduled to be completed in the summer of 2020, but was delayed due to the COVID-19 pandemic that began when the review was in its initial scoping stages.

History of the GSRP

During the Cold War, security reporting was integrated into political reporting by Canadian diplomats abroad. The Canadian security and intelligence (S&l) community largely relied on this foreign security reporting to meet its information needs. Following the end of the Cold War, security reporting was no longer routinely incorporated into political reporting by Canadian diplomats. The change was reflective of:

“an evolving world order, in which different, non-traditional security challenges arose; new and changing national and departmental priorities; the loss of subject matter expertise as diplomats and managers both moved on and retired; and significant public service cuts and budget restraints in the 1990s influenced GAC activities and priorities.”

GSRP was created soon after the events of 9/11. The contemporary Program has a unit of approximately 30 diplomatic personnel dedicated to overt single source* reporting — from a network of primarily “non-traditional” contacts — on issues pertinent to the Canadian security, intelligence, defence, and foreign policy community. GSRP. officers (or officers) operate within and outside of host country capitals and regularly travel to areas less frequented by most diplomats. Since 2009, these reports (which inform both Canadian and allied decision-makers), have been anchored in the GoC intelligence priorities.

GSRP officers report to the Intelligence Assessments and Reporting Division (INA) under the Intelligence Bureau which falls under the ADM of International Security and Political Affairs.” The GSRP adheres to a matrix management structure: at mission, GSRP officers report to the Foreign Policy and Diplomacy Service (FPDS) manager or Head of Mission (HoM), while GSRP Headquarters (HQ) primarily determines officer collection priorities. In addition, GSRP HQ defines the expectations for the Program.

Findings and recommendations

Utility of GSRP

The GSRP is the only Canadian diplomatic program that is dedicated and funded to collect overt security-related information. GSRP functions as a fenced resource wherein the majority of an officer’s time (90%) is devoted to the production of single- source reports. No other GAC program devotes similar resource allocation to “pure collection”.

GSRP’s clients repeatedly stated that the reports provide pertinent information consistent with their department/agency’s collection requirements. Specifically, GSRP reporting provides “on-the-ground” perspectives from a diverse group of individuals, which is unique in comparison to other GoC collection streams. Recipients mentioned the reports provide useful information on broader threats and trends in areas of emerging interest.

Clients reported that one of the greatest assets of the GSRP is the priority placed on language training. This includes, in some cases, over a year of training, including immersive in-country exposure.’ GSRP clients have noted that language fluency is a key value of the Program.

Moreover, clients commended the Program’s ability to rapidly deploy officers to cover a specific area, event, or issue that is of significant value to the GoC. Despite these benefits, review of GSRP documentation indicates the need for improved product feedback mechanisms to help determine whether reports meet client needs”.

Duties and Functions under the Vienna Convention on Diplomatic Relations

The lawful functions of a diplomatic mission and the duties owed by diplomats who enjoy privileges and immunities in a receiving state are articulated in the Vienna Convention on Diplomatic Relations (VCDR). The VCDR is generally accepted as a codification of diplomatic law, rules and practices under customary international law. According to GAC, the GSRP falls within the functions of a diplomatic mission, as listed in Article 3 of the VCDR. As outlined under Article 3(1)(d), it forms part of the function of a diplomatic mission to ascertain, by all lawful means, the conditions and developments in the host state and report on them to the government of the sending state. Article 3(1)(d) specifically requires diplomatic reporting to be “by lawful means.”

Under Article 41(1) of the VCDR, it is the duty of diplomats exercising the functions listed under Article 3 and who enjoy privileges and immunities in the receiving state “to respect the laws and regulations of the receiving state” and “not to interfere in the internal affairs of that state”. Breaches of these duties constitute abuses of privileges and immunities (also referred to as abuses of diplomatic functions).

Remedies for abuse of diplomatic privileges and immunities

Remedy for abuse of diplomatic privileges and immunities, as outlined in the VCDR, includes notifying the sending state that a diplomat in question is declared persona non grata (Article 9 of the VCDR) and, in the most exceptional circumstances, breaking off diplomatic relations, which are established by mutual consent as articulated in Article 2 of the VCDR.

Importantly, these remedies do not require the host state to give reasons for the remedial action. The result is that the perception of abuse can be as likely a cause for expelling a diplomat or even breaking off diplomatic relations as an actual abuse. The International Court of Justice in the Tehran Hostages Case explained the discretion built into this regime as follows:

Article 9 of the [VCDR]… take[s] account of the difficulty that may be experienced in practice of proving such abuses in every case or, indeed, of determining exactly when exercise of the diplomatic function”…”may be considered as involving such acts as “espionage” or “interference in internal affairs”. The way in which Article 9 paragraph 1, takes account of any such difficulty is by providing expressly in its opening sentence that the receiving state may “at any time and without having to explain its decision” notify the sending state that any particular member of its diplomatic mission is “persona non grata” or “not acceptable”… Beyond that remedy for dealing with abuses of the diplomatic function by individual members of a mission, a receiving state has in its hands a more radical remedy if abuses of their functions by members of a mission reach serious proportions. This is the power which every receiving state has, at its own discretion, to break off diplomatic relations with a sending state and to call for the immediate closure of the offending mission. (emphasis NSIRA’S).

The personal immunity enjoyed by diplomats will normally cease when the functions of the diplomat have come to an end and “at the moment when he leaves the country, or on expiry of a reasonable period in which to do so. There are circumstances wherein the receiving state may prosecute a diplomat for those breaches that contravene their domestic law where the personal diplomatic immunity enjoyed by the diplomat has ceased.

Acts performed by a diplomat “in the exercise of his functions as a member of the mission” will continue to be covered by immunity despite the diplomat’s personal immunity having ended. However, acts falling outside of a diplomat’s legitimate functions will not continue to be covered by immunity, and the diplomat may be liable to prosecution for illegal acts they performed during the mission if they later re-enter the receiving state without the protection of diplomatic immunity or where they fail to leave the receiving state within a reasonable time.

There are of course other less severe means at the receiving state’s disposal to respond to a diplomat’s abuse of functions, both legal and political. Aside from the more unlikely risks of expulsion or severing of diplomatic relations, there is a wide spectrum of reputational harm that may result from perceived breaches of the VCDR. NSIRA emphasizes that GSRP officers should be wary of placing a receiving state in the position to seek remedy.

Where the GSRP activities depart from the legal framework for diplomatic functions in international law, attention should also be turned to whether these activities are lawful under Canadian law. Diplomatic relations are conducted under the authority of Crown Prerogative over foreign relations, which is constrained, to some extent, by international law. Prohibitive rules of customary international law, which would include prohibitive rules of diplomatic law, are considered to be incorporated into Canadian common law unless there is legislation to suggest the contrary. Crown Prerogative is likewise part of our common law. Consideration must be given as to how the exercise of Crown Prerogative reconciles with these prohibitive rules.

Perceptions

Diplomatic vs. Intelligence Functions

Existing within GAC’s intelligence bureau, the GSRP’s reporting directions are derived from Canada’s intelligence priorities. Nonetheless, GAC characterized the Program to NSIRA as being consistent with regular diplomatic reporting. Effectively, NSIRA views the Program as existing within a grey zone between these two dichotomies.

GSRP officers are posted to countries to collect information relevant to the GoC’s intelligence priorities. These countries are often characterised by poor human rights records; a high degree of mistrust for outsiders; often take a hard line on internal security matters; and, tend to deploy mass surveillance on foreigners and citizens. This is why the perception of GSRP activities by receiving states is a relevant consideration for the Program.

When NSIRA asked how the Program accounts for disparities between what are legally permitted activities and the laws of the receiving state, GSRP officers were insistent that they operate under the VCDR.”’ Although officers acknowledged that they have a right under diplomatic law to fulfill their duties, they also understood that the receiving state might perceive their role differently. To help mitigate this risk, some officers indicated that they avoid reporting on sensitive topics.

Although the GSRP reports on intelligence priorities and obtains information from human contacts, officers believe they are distinct from intelligence practitioners given that they operate overtly as accredited members of a diplomatic mission, and do not pay or task their contacts. Despite these assertions, whether the actions of the GSRP officer are “overt” or “covert”, and whether or not they task or pay contacts, is not determinative when assessing for an abuse of privileges and immunities under the VCDR. In fact, many cases where interference activities have attracted the attention of receiving states were clearly overt.

Risk

GSRP officers must be alert to any activity that may be perceived by receiving states as falling outside of the functions of a diplomatic mission. This portion of the review briefly outlines some of the attendant risks.

Risk to the Government of Canada and its Allies

NSIRA expected to find a GSRP governance framework that articulates internal policies and provides guidance to GSRP officers on how to perform their diplomatic reporting functions. Such a governance framework does not exist.

When questioned on the absence of a governance framework, GSRP indicated that a policy suite was unnecessary given that officers “are doing what diplomats have always done.” Although GSRP management noted that they are working towards professionalizing the Program, policy is currently:

established by the Head of the GSRP, exercising their judgement and discretion, and drawing on specialized expertise, including support from legal, human resources and finance divisions, and seeking formal or informal approval from senior executives as required and when appropriate.

Policy guidance provided by the Head of GSRP is disseminated to officers via email. There is no central repository to organize this information. In addition to a lack of information management structures, there are information management weaknesses in other areas, including multiple incompatible systems and various security accreditations across missions. Additionally, some information is solely held at mission, limiting HQ’s visibility and oversight of mission developments.

As a result of the absence of a sufficient governance structure, information management challenges and limited oversight of mission developments, there have been instances where the Program has not managed risk appropriately.

For example, the review observed instances in which Canada’s allies misidentified GSRP officers as Canadian intelligence representatives.

Although NSIRA did not observe any instances where GSRP officers intentionally mislead receiving states, in one case, the lack of understanding of the Program’s mandate [redacted].

Some recipients of GSRP reports also indicated that other recipients (particularly those with limited security and intelligence backgrounds) do not fully understand that these products are single-source, unvalidated, or uncorroborated. This is particularly relevant given that GSRP officers have in the past unwittingly reported information that turned out to be misinformation and disinformation. Of note, GSRP produced just over five thousand reports over the review period, with two significant instances of confirmed disinformation in ten reports. Moreover, recipients repeatedly referred to misinformation in GSRP reports, yet NSIRA was unable to independently corroborate all of the Program’s reports over the review period.

As already noted, one of the challenges facing the Program is the absence of sufficient oversight. Four full time employees at HQ are responsible for the management of approximately thirty officers, the vetting of approximately two thousand reports per year, for providing informal policy guidance, and conducting outreach with relevant stakeholders. This deprives HQ of the capacity to perform adequate quality control of officer activities.

Finding no. 1: NSIRA found that GSRP’s governance and accountability structures are insufficiently developed.

Finding no. 2: NSIRA found that GSRP activities have the potential to cause unnecessary reputational and political harm to the Government of Canada.

Finding no. 3: NSIRA found that GSRP does not adequately maintain central repositories or follow information management best practices.

Recommendation no. 1: NSIRA recommends GSRP prioritize the development of a governance framework.

Recommendation no. 2: NSIRA recommends that GAC enforce data retention and information management practices as laid out in already-existing GoC policies.

GAC-CSIS Operational Partnership

CSIS has a framework that outlines host country expectations, both politically and operationally. The CS/S Act specifies, under section 17, how these arrangements are to be governed. In addition, there is Ministerial Direction that further guides CSIS’ conduct abroad. This governance framework structures CSIS’ operations to be consistent with domestic and international law. In most cases, CSIS prefers to be the primary interlocutor with foreign security or intelligence partners, just as GAC prefers to be the primary contact with diplomatic representatives.

In at least one instance, GSRP was a primary contact with a foreign intelligence agency instead of CSIS. In this instance, GAC refused to approve a Section 17 relationship between CSIS and [redacted] due to an ongoing sensitive diplomatic case. However, NSIRA did not observe anything to indicate these same relationship prohibitions were extended to RCMP or GSRP. Regardless of the circumstances, in cases where CSIS is prohibited from engaging a foreign entity due to restrictions on the foreign arrangement, GAC does not have the same restrictions.

Moreover, where CSIS and GAC have identical legal obligations under the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA), these obligations risk being applied differently. For example, where CSIS has controls on who they can and cannot liaise with as derived from Ministerial direction (i.e. s.17, CS/S Act), GAC does not have comparable restrictions. Rather, GAC relies on internal mitigation processes when sharing information with foreign entities, which for CSIS, are only relevant if the Minister permits the Service to engage with that entity to start with.

Although GSRP management stated that it is not the role of officers to liaise with foreign security and intelligence agencies, GSRP officers did not consistently articulate this to NSIRA. For instance, some officers interacted with members of local intelligence agencies, while others mentioned that they consider this to be outside their mandate.

In several instances, CSIS was asked by receiving states to clarify what was perceived to be inappropriate activities by GSRP officers. In these cases, CSIS. attempted to reassure these partners that the GSRP was not a covert collection program. NSIRA also observed coordination challenges in regions where CSIS and GSRP activities overlap (e.g. contact pools).

NSIRA heard from multiple GSRP officers that they generally found CSIS partners at missions collegial and forthcoming with security advice.” In one other instance, the GSRP officer reported a hostile relationship with their CSIS counterpart.

NSIRA also observed numerous cases where it did not appear that GSRP officers had adequately productive relationships with CSIS at mission. In these instances, although individuals were cordial, there was minimal interaction, with CSIS officers often keeping to themselves. Although NSIRA understands the legal protections pertaining to CSIS information sharing, there appeared to be a lack of consistent deconfliction and interaction between GSRP and CSIS in the field.

When NSIRA raised the issue of deconfliction overseas, GSRP management maintained that such mechanisms were unnecessary given that CSIS is a client, and not a partner, of the Program Although CSIS is indeed a client of GSRP reporting, the above also clearly indicates that the GSRP and CSIS operate in close proximity to each other overseas, with attendant relationship complexities that must be managed.

CSIS and GAC both participate in a Joint Management Team (JMT), which convenes at the Director General and Deputy Minister levels. NSIRA observed that although there is potential for the JMT to serve as an effective deconfliction mechanism, there was no evidence that key takeaways concerning GSRP and CSIS collaboration were acted upon. Further, the JMT convenes too infrequently to have a lasting or substantive impact.

Finding no. 4: NSIRA found that there is insufficient deconfliction between CSIS and GSRP, which results in inconsistent governance when engaging foreign entities.

Recommendation no. 3: NSIRA recommends the development of clear deconfliction guidelines between CSIS and GSRP and that there must be a consistent approach by CSIS and GSRP when engaging with foreign entities overseas.

Risk to Officers

GAC advised that they have no legal opinions on the legal framework for the GSRP. NSIRA observes that not enough attention has been turned to ascertaining the scope of the functions of a diplomatic mission as described by Article 3(1)(d) and the duties outlined in Article 41(1) of the VCDR, as well as the types of activities that may expose GSRP officers to being declared persona non grata by the receiving state. One area of particular ambiguity is the broad concept of diplomatic interference under Article 41(1) which is not clearly defined under diplomatic law and requires further consideration. The more sensitive a GSRP officer’s conduct, the more likely a receiving state may perceive interference. In addition, thresholds for interference will likely differ between states.

Similarly, where GSRP activity takes on the perceived attributes of espionage, there is increased risk of exceeding the GSRP mandate, violating the receiving state’s domestic law, and exceeding the GSRP officer’s legal diplomatic functions. These risks require further consideration by GAC’s legal and policy team, as outlined further below.

The risks of not creating a legal and policy framework could result in reputational harm to Canada and its diplomatic relations, and presents risks to the individual GSRP officers. NSIRA observed that many GSRP officers routinely relied on the VCDR as a shield for their actions. Indeed, officers did not appear to appreciate that a breach of their obligations under the VCDR amounts to an abuse of their diplomatic privileges and immunities. Article 3(1)(d) of the VCDR recognizes reporting information ascertained through lawful means. Any departure from this requirement would mean that a GSRP officer runs a risk of not being protected by immunity once the GSRP officer’s personal immunity ceases at the end of the individual’s diplomatic posting.

GAC’s Conduct Abroad Code explicitly acknowledges that host country local norms are to be followed by Canadian representatives and that perceptions of Canadian representatives may have a negative effect on Canada’s reputation. Additionally, the activities of GSRP officers are governed by other protocols, which cover the risk of natural disasters, local health concerns, crime, and the physical security of the mission.

In order to collect pertinent information, GSRP officers often travel to dangerous regions not regularly frequented by other diplomats. In addition, GSRP officers also engage with contacts who may hold viewpoints that are considered sensitive by receiving states. Obviously, these contacts would be of little value to the Program if the information/perspective they possess could be collected anywhere. Although all diplomats can attract attention of local authorities, given the nature of the GSRP’s mandate, officers are at particular risk of scrutiny by receiving states.

There also appears to be a disconnect between GSRP HQ and mission management. Namely, there does not appear to be a shared accountability structure. As a result, this undermines the primacy of any one of the managing parties. For example, NSIRA observed multiple instances in which the reporting structure was not clear either for Program partners or for GAC management. For example, the time lag for receiving critical guidance placed one officer at risk of continuing activities which could have been perceived as non-compliant with the VCDR.

GSRP officers do not receive adequate training or briefings on the parameters of diplomatic privileges and immunities. This lack of knowledge may have serious consequences on the GSRP officer’s ability to conduct themselves in accordance with their diplomatic duties. In addition, once a GSRP officer is no longer afforded diplomatic immunity, a receiving state may seek retaliatory measures.

Case Study: Accepting and reporting on classified information

During the course of the review, NSIRA observed many instances where GSRP officers claimed to have a good understanding of their legal boundaries. However, an instance that occurred in [redacted] highlighted the need to ensure that GSRP officers are properly aware of their legal obligations. In this case, a GSRP officer received what appeared to be classified [redacted] from a contact.

Like Canada, [redacted] has laws prohibiting the disclosure of classified information. The GSRP officer’s actions must comply with [redacted]. In addition, Article 41 of the VCDR is clear that diplomats are required to respect the laws and regulations of the receiving state. NSIRA did not see any indication that consultation with legal counsel occurred in this particular case.

In another case, a GSRP officer [redacted] requested and received what was likely classified information from a contact. The information received included [redacted].

In both of the cases examined above, the two GSRP officers appeared to believe that their actions were distinguishable from the activities of an intelligence officer because they did not pay for the information. As noted previously, this is not pertinent when considering compliance with the VCDR; moreover, the aforementioned cases raise concerns related to abuses of diplomatic privileges.

GSRP officers do not have clear guidelines on how to proceed when exposed to information that falls outside the limits of diplomatic collection. NSIRA did observe one instance in which a GSRP officer was given suspected classified information and appropriately returned it to the contact. However, this result was a consequence of the good judgment exhibited by the officer, rather than derived from explicit direction.

Finding no. 5: NSIRA found there was an absence of risk assessments and security protocols specific to the increased scrutiny that GSRP officers may attract because of the nature of their reporting priorities.

Finding no. 6: NSIRA found that although the GSRP operates under the VCDR, it does so without adequate legal guidance assessing the activities of the Program.

Finding no. 7: NSIRA found that GSRP officers do not receive adequate training regarding their legal obligations.

Recommendation no. 4: NSIRA recommends that GSRP develop risk protocols and security guidelines specific to the GSRP.

Recommendation no. 5: NSIRA recommends that GAC complete a thorough legal assessment of GSRP activities. GSRP officers should receive applicable training based on the result of the assessment.

Risk to Contacts

As already explained above, the more sensitive a GSRP officer’s conduct, the more likely a receiving state will perceive interference. This is particularly true with respect to officer interactions with contacts. It is important to underscore that the assumed diplomatic protections granted to the GSRP officer do not apply to contacts. As such, everything depends on a) the degree to which the contact is genuinely free to share such information with a foreign state and b) the degree to which the GSRP officer’s activities do not raise unnecessary suspicion about this interaction.

GSRP officers reported many different experiences regarding risk and security for their contacts, consistent with the diverse environments in which they operate. Most GSRP officers believed that there was little reason to be concerned for contacts, irrespective of the environment, given the overt nature of the collection. In cases where officers acknowledged that certain regions and/or circumstances created a higher risk to the contact, these situations were often mitigated by following the lead of the contact. In other words, given that the contact was most familiar with the environment, the GSRP officer paid close attention to these sensitivities.

In some instances however, GSRP officers mentioned concern for the security of their contacts, which could not be easily mitigated. One GSRP officer noted in an interview that his contact informed him that their interactions would garner unwanted attention by local authorities. Similarly, another GSRP contact was detained by the local authorities and questioned about his interaction with a GSRP officer. In other instances, GSRP officers reported political turmoil or increased security as reasons why contacts suddenly stopped talking to them.’”

Throughout the course of this review, the implications of the differences between overt contacts and clandestine sources were ever-present. In many respects, GSRP. management’s contention that a contact cannot be perceived in the same manner as an intelligence source is accurate. Certainly, most GSRP officers’ interactions with contacts are innocuous. However, given the very nature of the reporting requirements for the Program, there were cases where the contact’s interactions with the officer were high risk. Such examples include GSRP [redacted] speaking with various individuals in [redacted].

These topics and regions are not only widely known as highly sensitive to the receiving states, but also align closely with what a covert source may be tasked to collect information on.

The problem facing the Program from a “contact management” perspective is that anything that takes on the trappings of a “source management” program lends itself to appropriate criticism of being too closely affiliated to non-diplomatic reporting. For example, although the Program would benefit from some of the best practices of HUMINT management, discerning precisely which aspects would be most beneficial, while remaining a diplomatic program, is a key challenge.

In the absence of a “contact management” governance structure, it is therefore left to the best judgment of individual officers on how these interactions are to transpire. This includes the officer determining who to meet, where to meet, and what security protocols are most appropriate in the given circumstances.

In some cases, the officer took it upon themselves to try to enhance security for the contact, including setting up meeting venues minutes before in order to decrease the likelihood of third parties discovering the meeting location. In another example, the officer attempted to obscure mobile device tracking with a faraday bag.

Although these measures were undertaken with the best interest of the contact at hand, intelligence services observing these behaviours could draw an alternative perspective about the intent of such behaviours. Most notably, this could run the risk that GSRP contacts would be perceived by receiving states as assets of a hostile intelligence service.

Irrespective of the environment, or the comfort of the contact, there was also inconsistency in how GSRP officers provided assurances to contacts. For example, while some officers reassured contacts that there is anonymity or confidentiality in GSRP reports, others did not. There was no evidence of a consistent understanding among officers on what assurances could be offered to contacts, or if contacts fully understood what would be done with the information they provided.

Recipients of GSRP reports repeatedly mentioned the ease at which they were able to identify contacts from the descriptions in the reports. Significantly, the majority of officers mentioned that they also report on meetings with Canadian contacts. The anonymization of Canadians is particularly important with regard to ensuring that GAC is meeting its obligations under the Privacy Act and other pertinent legislation. NSIRA will examine the issue of the GSRP meeting their information-sharing obligations with regard to Canadian contacts in the future.

Finding no. 8: NSIRA found that the GSRP does not have appropriate safeguards for interactions with contacts overseas.

Recommendation no. 6: NSIRA recommends that GSRP develop best practices for interactions with contacts based on consultation with GAC legal advisors.

Recommendation no. 7: NSIRA recommends that GAC conduct a Privacy Impact Assessment of the GSRP.

Conclusion

GSRP operates in a distinctly grey zone; GSRP’s vision for the Program includes “greater integration of intelligence community standards and best practices into the GSRP, while maintaining its diplomatic ethos”. Reconciling what this means, in practice, is the most pressing challenge facing the Program.

Reciprocity is an important element of diplomacy. The activities of certain GSRP officers abroad raises concerns that Canada’s diplomats are at times not conducting themselves in accordance with their duties and functions under the VCDR, and of consequence, this may inadvertently influence how these states conduct activities in Canada.

There is a strong appetite for foreign intelligence collected by Canadians. Academics and senior officials from various departments have made clear that Canada’s allies are also eager for Canada to be more involved.

The creation of a foreign intelligence entity within GAC, or the allowance of mission creep by the GSRP into this area of collection, would run against the principles of the VCDR. Therefore, it is important that the GoC consider the implications stemming from this review and decide on the most appropriate means of collecting this kind of information. NSIRA appreciates that issues raised in this review necessarily evoke a renewed conversation on a dedicated Canadian foreign intelligence agency. This is, however, beyond the remit of NSIRA and may require consideration by the NSICoP.

Annex A: Findings and Recommendations

Finding no. 1: NSIRA found that GSRP’s governance and accountability structures are insufficiently developed.

Finding no. 2: NSIRA found that GSRP activities have the potential to cause reputational and political harm to the Government of Canada.

Finding no. 3: NSIRA found that GSRP does not adequately maintain central repositories or follow information management best practices.

Finding no. 4: NSIRA found that there is insufficient deconfliction between CSIS and GSRP which results in inconsistent governance when engaging foreign entities.

Finding no. 5: NSIRA found there was an absence of risk assessments and security protocols specific to the increased scrutiny that GSRP officers may attract because of the nature of their reporting priorities.

Finding no. 6: NSIRA found that although the GSRP operates under the VCDR, it does so without adequate legal guidance assessing the activities of the Program.

Finding no. 7: NSIRA found that GSRP officers do not receive adequate training regarding their legal obligations.

Finding 8: NSIRA found that the GSRP does not have appropriate safeguards for interactions with contacts overseas.

Recommendation no. 1: NSIRA recommends GSRP prioritize the development of a governance framework.

Recommendation no. 2: NSIRA recommends that GAC enforce data retention and information management practices as laid out in already-existing GoC policies.

Recommendation no. 3: NSIRA recommends the development of clear deconfliction guidelines between CSIS and GSRP and that there must be a consistent approach by CSIS and GSRP when engaging with foreign entities overseas.

Recommendation no. 4: NSIRA recommends that GSRP develop risk protocols and security guidelines specific to the GSRP.

Recommendation no. 5: NSIRA recommends that GAC complete a thorough legal assessment of GSRP activities. GSRP officers should receive applicable training based on the result of the assessment.

Recommendation no. 6: NSIRA recommends that GSRP develop best practices for interactions with contacts based on consultation with GAC legal advisors.

Recommendation no. 7: NSIRA recommends that GAC conduct a Privacy Impact Assessment of the GSRP.

Share this page
Date Modified:

Review of Air Passenger Targeting by the Canada Border Services Agency (CBSA)

Date of Publishing:

Executive Summary

The Canada Border Services Agency (CBSA)’s Air Passenger Targeting program performs pre-arrival risk assessments on inbound passengers. It seeks to identify passengers that may be at higher risk of being inadmissible to Canada or of otherwise contravening the CBSA’s program legislation. It does so by using information submitted by commercial air carriers called Advanced Passenger Information and Passenger Name Record data in a multi-stage process that involves manual and automated triaging methods, referred to as Flight List Targeting and Scenario Based Targeting.

The Advance Passenger Information and/or Passenger Name Record data used to perform these prearrival risk assessments include personal information about passengers that relates to prohibited grounds of discrimination under the Canadian Human Rights Act and the Canadian Charter of Rights and Freedoms (the Charter). These grounds include age, sex, and national or ethnic origin. The CBSA relies on information and intelligence from a variety of different sources to determine which of these data elements indicate a risk in passengers’ characteristics and travel patterns in the context of specific enforcement issues, including national security-related risks. Given their potential importance for Canada’s national security and for the CBSA’s concurrent obligations to avoid discrimination, attention to the validity of the inferences underpinning the CBSA’s reliance on the particular indicators it creates from this passenger data to perform these risk assessments is warranted. These considerations also have implications for Canada’s international commitments to combat terrorism and serious transnational crime and to respect privacy and human rights in the processing of passenger information.

NSIRA conducted an in-depth assessment of the lawfulness of the CBSA’s activities in the first step of the pre-arrival risk assessment, where inbound passengers are triaged using the passenger data provided by commercial air carriers. The review examined whether the CBSA complies with restrictions established in statutes and regulations on the use of the Advance Passenger Information and Passenger Name Record data and whether the CBSA complies with its obligations pertaining to non-discrimination.

While NSIRA found that the CBSA’s use of Advance Passenger Information and Passenger Name Record data complied with the Customs Act, the CBSA does not document its triaging activities in a manner that enables effective verification of compliance with regulatory restrictions established under the Protection of Passenger Information Regulations. This was more of a weakness in the CBSA’s manual Flight List Targeting triaging method than its automated Scenario Based Targeting method.

The CBSA was also unable to consistently demonstrate that an adequate justification exists for its reliance on particular indicators it created from the Advance Passenger Information and Passenger Name Record data to triage passengers. This is important, as the CBSA’s reliance on certain indicators results in drawing distinctions between travellers based on prohibited grounds of discrimination. These distinctions may lead to adverse impacts on passengers’ time, privacy, and equal treatment, which may be capable of reinforcing, perpetuating or exacerbating a disadvantage. Adequate justification for such adverse differentiation is needed to demonstrate that such distinctions are not discriminatory and are a reasonable limit on travellers’ equality rights.

Recordkeeping is important to ensure effective verification that Air Passenger Targeting triaging activities comply with the law and respect human rights and NSIRA observed important weaknesses in this regard. These recordkeeping weaknesses stem in part from the fact that the CBSA’s policies, procedures, and training are insufficiently detailed to adequately equip CBSA staff to identify discrimination and compliance-related risks and to act appropriately in their duties. Oversight structures and practices are also not rigorous enough to identify and mitigate potential compliance and discrimination-related risks. This is compounded by lack of collection and assessment of relevant data. NSIRA recommends improved documentation practices for triaging to demonstrate compliance with statutory and regulatory restrictions and to demonstrate that an adequate justification exists for its reliance on the indicators it creates from Advance Passenger Information and Passenger Name Record data. Such documentation is essential to enable effective internal oversight as well as external review.

NSIRA also recommends more robust training and increased oversight to ensure that triaging practices are not discriminatory. This should include updates to policies as appropriate as well as the collection and analysis of the data necessary to identify, analyze and mitigate discrimination-related risks

Front matter

Lists of acronyms

API Advance Passenger Information
APT Air Passenger Targeting
CBSA Canada Border Services Agency
CHRA COVID-19 EU Canadian Human Rights ActNovel Coronavirus/Coronavirus Disease of 2019European Union
FLT Flight List Targeting
IATA International Air Transport Association
ICES Integrated Customs Enforcement System
IRPA Immigration and Refugee Protection Act
IRPR Immigration and Refugee Protection Regulations
MOU Memorandum of Understanding
NSIRA National Security and Intelligence Review Agency
OAG Office of the Auditor General of Canada
OPC Office of the Privacy Commissioner
PAXIS Passenger Information System
PCLMTFA Proceeds of Crime (Money Laundering) and Terrorist Financing Act
PICR Passenger Information (Customs) Regulations
PNR Passenger Name Record
PPIR Protection of Passenger Information Regulations
RFI Request for Information
SBT Scenario Based Targeting
SOP Standard Operating Procedures
UNSC United Nations Security Council
US United States

Lists of figures

Figure 1. Advance Passenger Information and Passenger Name Record Elements

Figure 2. Steps in the Air Passenger Targeting

Figure 3. Process for Developing Scenarios for Scenario Based Targeting

Figure 4. What is a “High Risk” Flight or Passenger

Figure 5. Instances Where the Link to Serious Transnational Crime or Terrorism Offences was unclear

Figure 6. Instances Where the Potential Contravention was Unclear in Targets

Figure 7. Legal Tests under the CHRA and the Charter

Figure 8. Advance Passenger Information and Passenger Name Record Data That Relate to Protected Grounds

Figure 9. Instances Where Behavioural Indicators Were Protected Grounds or Did Not Narrow Scope

Figure 10. Impacts on Travellers Resulting from Initial Triage

Figure 11. Summary of NSIRA’s Assessment of Scenario Supporting Documentation

Figure 12. Examples of Weaknesses in Scenario Supporting Documentation

Figure 13. Example of a Well-Substantiated Scenario

Figure 14. Why the Justification for the Indicators Used in Targeting is Important

Authorities

The National Security and Intelligence Review Agency (NSIRA) conducted this review under paragraph 8(1)(b) of the NSIRA Act.

Introduction

The Canada Border Services Agency (CBSA)’s Air Passenger Targeting program is one of several programs that help the Agency fulfill its mandate of “providing integrated border services that support [Canada’s] national security and public safety priorities and facilitate the free flow of [admissible] persons and goods” into Canada. Air Passenger Targeting uses passenger data submitted by commercial air carriers called Advance Passenger Information and Passenger Name Record data to conduct pre-arrival risk assessments. The pre-arrival risk assessments are intended to identify individuals at higher risk of being inadmissible to Canada or of otherwise contravening the CBSA’s program legislation. In 2019-20, the CBSA received this information to risk assess 33.9 million inbound international travellers.

Air Passenger Targeting has become an increasingly important tool for screening passengers. The CBSA’s deployment of self-serve kiosks to process travellers arriving in Canadian airports has decreased the ability of Border Services Officers to risk assess travellers through in-person observations or interactions, increasing the CBSA’s reliance on pre-arrival risk assessments, like Air Passenger Targeting, to identify and interdict inadmissible people and goods.

The Canadian border context affords the CBSA considerable discretion in how it conducts its activities. Individuals have lower reasonable expectations of privacy at the border. Brief interruptions to passengers’ liberty and freedom of movement are reasonable, given the state’s legitimate interest in screening travellers and regulating entry. However, the activities of the CBSA must not be discriminatory, meaning that any adverse differential treatment on the basis of prohibited grounds of discrimination, such as national or ethnic origin, age, or sex must be justified. Both the Canadian Human Rights Act and the Canadian Charter of Rights and Freedoms (the Charter) create distinct obligations in this regard. The Advance Passenger Information and Passenger Name Record data that the CBSA uses to perform these pre-arrival risk assessments includes personal information about passengers that is either a prohibited ground of discrimination or that relates closely to such grounds, warranting further attention to the CBSA’s compliance with these obligations. As Air Passenger Targeting involves passenger screening to identify national security-related risks (among others), attention to the validity of the inferences underpinning the CBSA’s interpretation of passenger information also has implications for Canada’s national security.

Air Passenger Targeting also engages Canada’s international commitments to combat terrorism and serious transnational crime and to respect privacy and human rights in the processing of passenger information. The latter commitment has been of particular importance to the European Union in the context of ongoing negotiations on an updated agreement for sharing passenger information.

About the review

NSIRA’s review examined two main aspects of the lawfulness of the CBSA’s passenger triaging activities in Air Passenger Targeting and their effects on travellers. The review examined whether the CBSA’s triaging activities comply with restrictions established in statutes and regulations on the use of Advance Passenger Information and Passenger Name Record data; and whether passenger triaging activities comply with the CBSA’s obligations pertaining to non-discrimination under the Canadian Human Rights Act and the Charter.9 NSIRA expected to find that the CBSA’s triaging activities are conducted with appropriate legal authority and comply with use restrictions on the passenger data and non-discrimination obligations, namely, that any adverse differentiation among travellers based on protected grounds is supported by adequate justification.

The review focused on the CBSA’s triaging activities in Air Passenger Targeting relevant to identifying potential national security-related threats and contraventions. However, it also examined the program as a whole across the CBSA’s three main targeting categories—national security, illicit migration, and contraband—to fully appreciate the program’s governance and operations, given its reliance on intelligence analysis. The review examined the Air Passenger Targeting program as implemented by the CBSA between November 2020 and September 2021.

The review relied on information from the following sources:

  • Program documents and legal opinions
  • Information provided in response to requests for information (written answers and briefings)
  • [***Sentence revised to remove privileged or injurious information. It describes the number of scenarios that were active on May 26, 2021***]
  • Supporting documentation for a sample of 12 scenarios that were active on May 26, 2021
  • A sample of 83 targets issued between January and March 2021 (including 59 targets subsequent to Flight List Targeting and 24 targets subsequent to Scenario Based Targeting)
  • A live demonstration at the National Targeting Centre, which conducts Air Passenger Targeting
  • Open sources, including news articles, academic articles, and prior reviews by other agencies.
  • Past performance data and relevant policy developments

Confidence statement

For all reviews, NSIRA seeks to independently verify information it receives. Access to information was through requests for information and briefings by the CBSA. During this review, NSIRA corroborated the information that was received through verbal briefings by receiving copies of program files and alive demonstration of Air Passenger Targeting. NSIRA is confident in the report’s findings and recommendations.

Orientation to the Review Report

After providing essential background information on the steps and activities involved in Air Passenger Targeting and its contribution to the CBSA’s mandate in Section 5, the review’s findings and recommendations are presented in Section 6.

In Section 6.1, NSIRA’s assessed the CBSA’s compliance with statutory and regulatory restrictions on the CBSA’s use of Advance Passenger Information and Passenger Name Record data. Weaknesses in how the CBSA documents its Air Passenger Targeting program activities prevented NSIRA from verifying that all triaging activities complied with these restrictions. These weaknesses also impede the CBSA’s own ability to provide effective internal oversight.

In Section 6.2, NSIRA’s assessed the CBSA’s compliance with its obligations pertaining to nondiscrimination under the Canadian Human Rights Act and the Charter. Similar weaknesses in documentation and recordkeeping prevented the CBSA from demonstrating, in several instances, that an adequate justification exists for its reliance on the indicators it created from Advance Passenger Information and Passenger Name Record data to triage inbound travellers. Ensuring that Air Passenger Targeting triaging practices are substantiated by relevant, reliable and documented information and intelligence is important to demonstrating that travellers’ equality rights are being respected, given that some of the indicators relied on to triage passengers relate to protected grounds and given that passenger triage may lead to adverse impacts for travellers. NSIRA recommends a number of measures to improve recordkeeping and identify and mitigate discrimination-related risks.

Background and content

Air Passenger Targeting and the CBSA’s Mandate

The Air Passenger Targeting program is housed within the National Targeting Centre and is currently supported by 92 Full-Time Equivalents. Air Passenger Targeting is one of several targeting programs at the CBSA, and pre-arrival risk assessments are also performed on cargo and conveyances in other modes of travel, such as marine or rail. Pre-arrival risk assessments are currently only performed on crew and passengers for commercial-based air and marine travel. Screening and secondary examinations of travellers entering Canada through other modes of travel such as land or rail are undertaken at the border.

The Air Passenger Targeting pre-arrival risk assessments are intended to help front line Border Services Officers to identify travellers and goods with a higher risk of being inadmissible to Canada or of otherwise contravening the CBSA’s program legislation and referring them for further examination once they arrive at a Canadian Port of Entry.

Pre-arrival risk assessments are performed in relation to multiple enforcement issues, all of which are associated with ever-evolving travel patterns and traveller characteristics that may vary from one part of the world to the other. Staff at the National Targeting Centre receive training, develop on-the-job experience, and have access to a large body of information and intelligence to perform their duties.

How Air Passenger Targeting works

Key Information Relied Upon in Air Passenger Targeting

Air Passenger Targeting relies on two sets of information to triage passengers for these risk assessments. The first set consists of information about passengers that commercial air carriers submit to the CBSA under section 148(1)(d) of the Immigration and Refugee Protection Act and 107.1 of the Customs Act. This information is referred to as Advance Passenger Information and Passenger Name Record data. Advance Passenger Information comprises information about a traveller and the flight information associated with their travel to Canada; Passenger Name Record data is not standardized and refers to information about a passenger kept in the air carrier’s reservation system. The particular data elements are prescribed under section 5 of the Passenger Information(Customs) Regulations and section 269(1) of the Immigration and Refugee Protection Regulations.

For simplicity, NSIRA refers to Advance Passenger Information and Passenger Name Record Data collectively as “passenger data” in this review unless otherwise specified. Figure 1 provides an overview of common Advance Passenger Information and Passenger Name Record data elements. Once received by the CBSA, the passenger data is loaded into the CBSA’s Passenger Information System (PAXIS). This is the main system used to conduct Air Passenger Targeting.

Figure 1. Advance Passenger Information and Passenger Name Record Elements
Figure 1: Advance Passenger Information and Passenger Name Record Elements Graphic

The second set consists of information and intelligence from a variety of other sources that is used to help the CBSA determine which Advance Passenger Information and Passenger Name Record data elements may indicate risks in passengers’ characteristics and travel patterns in the context of specific enforcement issues and can therefore provide indicators for triaging passengers. Key sources include:

  • Recent significant interdictions that are cross-referenced with historical enforcement and intelligence information, as well as with the Advance Passenger Information and/or Passenger Name Record data for interdicted subjects
  • Port of entry seizures
  • Information from Liaison Officers overseas
  • International intelligence bulletins
  • Intelligence products shared by domestic and international partners concerning actionable indicators and trends from partner agencies based on their area of expertise.
  • Open sources, including news articles, op-eds, academic articles, social media.
  • CBSA intelligence products based on one or more of the above-mentioned sources, such as Intelligence Bulletins, Targeting Snapshots or Placemats, Country Threat Assessments, Intelligence Briefs, daily news briefings.

The quality of the information supporting the CBSA’s inferences as to who may be a high-risk traveller is important to ensure the triage is reasonable and non-discriminatory (see Section 6.2).

Step by Step Process of Air Passenger Targeting

Air Passenger Targeting involves three key steps, illustrated in Figure 2. First, CBSA officers triage passengers based on the Advance Passenger Information and Passenger Name Record data using manual or automated methods. Second, CBSA officers undertake a risk assessment of the selected passengers using different sources of information and intelligence. Third, Targeting Officers decide whether to issue a “target,” based on the results of this risk assessment.

Figure 2. Steps in the Air Passenger Targeting Process
Figure 2: Horizontal diagram of the steps in the Air Passenger Targeting Process

Step 1: Passenger Triage

The CBSA uses two distinct methods to triage passengers using Advance Passenger Information and Passenger Name Record data: Flight List Targeting and Scenario-Based Targeting.

Flight List Targeting is a manual triage method that involves two main steps. The officers use their judgement to make these selections (see Figure 4 for further details).

  • Targeting Officers select an inbound flight from those arriving that day that they consider to be at “higher risk” of transporting passengers that may be contravening the CBSA’s program legislation.
  • Targeting Officers then select passengers on those flights for further assessment, based on the details displayed about them in the list of passengers.

Scenario Based Targeting is an automated triage method that relies on “scenarios,” or pre-established set of indicators created from Advance Passenger Information and Passenger Name Record data elements that the CBSA considers as risk factors for a particular enforcement issue. The data for passengers on all inbound flights are automatically compared against the parameters of each scenario. Any passengers whose data match all of the parameters of one (or more) scenario are automatically selected for a Targeting Officer to assess further.

[***Sentence revised to remove privileged or injurious information. It describes the steps involved in developing scenarios ***]

Figure 3. Process for Developing Scenarios for Scenario Based Targeting

[***Figure revised to remove privileged or injurious information. It describes the steps involved in developing scenarios. ***]

Both of these triage methods are informed by an analysis of information and intelligence in slightly different ways. In Scenario Based Targeting, the National Targeting Centre’s Targeting Intelligence unit analyses intelligence and information to identify combinations of Advance Passenger Information and Passenger Name Record data elements associated with “high risk” passengers and travel patterns for the purposes of developing scenarios, as illustrated in Step 1 of Figure 3 above. In Flight List Targeting, Targeting Officers analyze information and intelligence to develop a personal “mental model” about what constitute “high risk” flights or passengers in the context of a specific enforcement issue. Examples are provided in Figure 4.

Figure 4. What is a “High Risk” Flight or Passenger?

Based on information about past trends and intelligence about future travel, CBSA officers identify certain flights or airports that have had a higher incidence of travellers subsequently found to be in contravention of the CBSA’s program legislation. The CBSA assesses flights from these points of origin as “high risk” flights. [Sentence revised to remove privileged or injurious information. It provided examples of flight information that the CBSA indicated was associated with past contraventions.]

Based on similar analysis, CBSA officers have assessed that certain combinations of traveller characteristics and travel patterns are or may be associated with contraventions of the CBSA’s program legislation. Travellers who match these characteristics are considered to be “high risk” travellers. [Sentence revised to remove privileged or injurious information. It provided examples of flight information that the CBSA indicated was associated with past contraventions.]

Steps 2 and 3: Passenger Risk Assessments and Issuing Targets

The initial triage of passengers may result in two additional steps for those who have been selected for further assessment: further passenger risk assessments (referred to by the CBSA as a “comprehensive review”) and a decision to issue a target if risks that were initially identified remain.

The passenger risk assessment process involves requesting and analyzing the following information to determine whether risks initially identified in the passenger’s Advance Passenger Information and Passenger Name Record data are no longer of concern (referred to as “negation”), whether they continue to be of concern, or whether those concerns have increased:

  • Mandatory and discretionary queries of CBSA and other government databases;
  • Open-source searches (including social media);
  • Requests for information to other Government of Canada departments and to the United States Customs and Border Protection agency (mandatory for all potential contraventions related to national security, but optional for other enforcement issues).

A target is issued when the risk assessment cannot “negate” risks initially inferred about the passenger. A target is a notification to Border Services Officers at a Canadian Port of Entry (in this case, airports) to refer the passenger for “secondary examination”. It does not mean that a passenger has been found in contravention of the CBSA’s program legislation. A target includes details about the passenger and the risks identified in relation to the potential contravention (referred to as a “target narrative”).

During secondary examinations, Border Services Officers engage in a progressive line of questioning. This questioning is informed by the details contained in the target as well as all other information available to the officers, including information provided by travellers and other observations developed during the examination. This information may allow the officers to establish a reasonable suspicion about whether the passenger has contravened customs, immigration, or other requirements that are enforced by the CBSA and pursue further questioning or examination. These examinations may also involve a search of luggage and/or digital devices where required and with managerial approval. The outcome of these examinations determines the next steps for individual travellers.

Findings and Recommendations

The CBSA’s Compliance with Restrictions Established in Law and Regulations

Restrictions that Apply to Air Passenger Targeting and Why They Matter

While Air Passenger Targeting is not explicitly discussed in legislation, both the Customs Act and the Immigration and Refugee Protection Act provide the CBSA with legislative authority to collect and use Advance Passenger Information and Passenger Name Record data in Air Passenger Targeting. Such use is further supported by section 4(1)(b) of the Protection of Passenger Information Regulations, which expressly contemplates the use of Passenger Name Record data to conduct trend analysis and to develop risk indicators for the purpose of identifying certain high-risk individuals.

NSIRA is satisfied that these statutory provisions also authorize the CBSA to collect and analyze the information and intelligence necessary to support Air Passenger Targeting. These inputs are necessary to contextualize its interpretation of the Advance Passenger Information and Passenger Name Record data and determine which data elements characterize “high risk” passengers and travel patterns in the context of different enforcement issues. However, the review did not examine whether all information and intelligence collected by the CBSA was necessary to the conduct of its operations (in Air Passenger Targeting or otherwise). This related topic may be the subject of future review.

These authorizing provisions create restrictions on the CBSA’s use of Advance Passenger Information and Passenger Name Record data. Two layers of use restrictions apply: one set arises from the Customs Act or the Immigration and Refugee Protection Act as authorizing statutes, and the other set arises from section 4 of the Protection of Passenger Information Regulations.

In examining compliance with the first set, NSIRA referred to section 107(3) of the Customs Act, the broader of the two authorities. Section 107(3) authorizes the CBSA to use Advance Passenger Information and Passenger Name Record data:

  • To administer or enforce the Customs Act, Customs Tariff, or related legislation;
  • To exercise its powers, duties and functions under the Immigration and Refugee Protection Act, including establishing a person’s identity or determining their inadmissibility; and/or
  • For the purposes of its program legislation.

NSIRA also examined compliance with the use restrictions established by section 4 of the Protection of Passenger Information Regulations. The regulations limit the CBSA’s use of Passenger Name Record data to the identification of persons “who have or may have committed” either a terrorism offence or a serious transnational crime. The data can be used to identify such persons directly, or to enable trend analysis or the development of risk indicators for that same purpose.

The Protection of Passenger Information Regulations were enacted to fulfill Canada’s commitments respecting its use of Passenger Name Record data as part of an agreement signed with the European Union. The Agreement specifies that “[Passenger Name Record] data will be used strictly for purposes of preventing and combating: terrorism and related crimes; other serious crimes, including organized crime, that are transnational in nature.” Although the 2006 agreement expired, ongoing efforts to negotiate a new agreement place continued importance on ensuring the CBSA’s ability to demonstrate compliance with the lawful uses of Passenger Name Record data. The constraints established in the regulations also indicate the Minister’s determination of when the use of Passenger Name Record data by the CBSA will be reasonable and proportional.

As a matter of law, the Protection of Passenger Information Regulations restrictions apply only to Passenger Name Record data provided to the CBSA under the Immigration and Refugee Protection Act. However, Advance Passenger Information and Passenger Name Record data are integrated within its systems. The CBSA also uses Passenger Name Record data to issue targets for the purposes of the Customs Act and the Immigration and Refugee Protection Act simultaneously. Given the CBSA’s commitments to the European Union under the above-mentioned Agreement and these other considerations, the CBSA observes these regulatory restrictions across its Air Passenger Targeting program as a matter of policy.

Assessing compliance with the Protection of Passenger Information Regulations required NSIRA to determine whether the enforcement issue of interest in the triaging decision fell within the regulations’ definitions of a “terrorism offence” or of a “serious transnational crime.”

What NSIRA found?

NSIRA found that, in its automated Scenario Based Targeting triaging method, the CBSA’s use of Advance Passenger Information and Passenger Name Record data to identify potential threats and contraventions of the CBSA’s program legislation complied with statutory restrictions. For its manual Flight List Targeting triaging method, NSIRA was not able to assess the reasons for the CBSA’s selection of individual travellers and was therefore not able to verify compliance with section 107(3) of the Customs Act. For both methods, NSIRA was also unable to verify that all triaging complied with the regulatory restrictions imposed by the Protection of Passenger Information Regulations on the CBSA’s use of Passenger Name Record data, namely that its use served to identify potential involvement in terrorism offences or serious transnational crimes. This was due to lack of precision in Scenario Based Targeting program documentation and lack of documentation about the basis for Flight List Targeting triaging decisions.

Do Scenario Based Targeting triage practices comply with statutory and regulatory restrictions?

In Scenario Based Targeting, all scenarios complied with the statutory restrictions on the use of Advance Passenger Information and Passenger Name Record data, as all scenarios were developed for the purposes of administering or enforcing the CBSA’s program legislation. However, in several instances, the scenario documentation did not precisely identify why the CBSA considered a particular enforcement concern to be related to a terrorism offence or serious transnational crime. This lack of precision obscured whether the scenarios complied with the Protection of Passenger Information Regulations.

NSIRA reviewed the information contained within the scenario templates for [***Sentence revised to remove privileged or injurious information. It describes the number of scenarios that were active on May 26, 2021***]. The templates require information on the specific legislative provisions associated with the potential contravention the scenario seeks to identify. The templates also require a general description of the details of the scenario, including the potential contravention.

The CBSA’s use of Advance Passenger Information and Passenger Name Record data in Scenario Based Targeting complied with the first layer of legal restrictions, as all of the scenarios sought to identify contraventions of the Immigration and Refugee Protection Act, the Customs Act, the Customs Tariff, and/or the Proceeds of Crime (Money Laundering) and Terrorist Financing Act, which are authorized purposes under section 107(3) of the Customs Act. In many instances, the scenario’s purpose also complied with the complementary restrictions under the Immigration and Refugee Protection Act.

Regarding the second layer of restrictions imposed by the Protection of Passenger Information Regulations, most scenarios cited provisions for potential contraventions that were reasonably viewed as relating to terrorism or serious transnational crime. In several instances, however, the link to terrorism or serious transnational crime was not clear. This occurred in one of two ways:

  • Scenarios did not establish why a potential contravention cited as the intent of the scenario was related to an offence punishable by a term of at least four years of imprisonment, which one of the criteria in the definition of a serious transnational crime. It was therefore unclear how the enforcement interest related to a serious transnational crime (observed in at least 28 scenarios).Including more precise details on how the potential contravention relates to a serious transnational crime or terrorism offence would more clearly establish this link.
  • Scenarios cited three or more distinct grounds for serious inadmissibility, such as sections 34, 35,36, and/or 37 of the Immigration and Refugee Protection Act without providing further details as to why all grounds were relevant to the conduct at issue in the scenario (observed in at least 20 scenarios).

This obscured how the grounds related meaningfully to the conduct at issue and why the conduct related to a terrorism offence or serious transnational crime. Including more precise details on how each ground of inadmissibility included in a scenario is relevant to the conduct at issue would help in this regard.

Illustrative examples are provided in Figure 5, and further details on NSIRA’s assessment of compliance with the Customs Act and the Protection of Passenger Information Regulations are provided in Appendix 8.3.

[Figure revised to remove privileged or injurious information. It described two examples where the link to serious transnational crime or terrorism offences was unclear in scenarios.]

Do Flight List Targeting triage practices comply with statutory and regulatory restrictions?

Lack of documentation about why officers selected particular flights or passengers prevented NSIRA from verifying whether Flight List Targeting triaging practices comply with the use restrictions found in the Customs Act or the Protection of Passenger Information Regulations. This lack of documentation also impedes the CBSA’s internal verification that Flight List Targeting triaging complies with these use restrictions.

As Targeting Officers rely on their judgement to triage passengers in Flight List Targeting, record keeping about triaging decisions is important to be able to verify that triaging complies with relevant statutes and regulations and take corrective action as appropriate. Although the National Targeting Centre has a Notebook Policy, which requires officers to “record all information about the officers’ activities,” the National Targeting Policy and the Air Passenger Targeting Standard Operating Procedures do not specify what stages of Air Passenger Targeting need to be documented or what information needs to be recorded at each step. Moreover, the Air Passenger Targeting Standard Operating Procedures, the Target Narrative Guidelines, and the format for issuing targets in the CBSA’s systems do not require officers to include precise details about the potential contravention that motivated their decision to issue a target.

NSIRA was only able to infer why a passenger was first selected for further assessment in Flight List Targeting from the details of targets, even though the explanatory value of analyzing targets for insight about initial triaging is limited. Targets are not issued for all initially selected passengers : only 15 percent of the passengers that were selected for a comprehensive risk assessment led to a target being issued in 2019-20.

As well, the enforcement issue contained within targets may have changed during later stages in the Air Passenger Targeting process and may not necessarily reflect the issue that motivated the initial triaging decision.

NSIRA found that all targets in a sample of 59 targets issued subsequent to Flight List Targeting complied with the first layer of use restrictions under section 107(3) of the Customs Act, as they cited either the “IRPA” or the “Customs Act” in the details of the target. However, the targets did not always specify a particular contravention of these Acts, which created a challenge for determining why the officers’ interest in the passenger related to a terrorism offence or serious transnational crime. Based on other descriptive details about the behaviours or risk factors contained in the target, it was only possible to clearly infer the enforcement issue and determine that it was a terrorism offence or a serious transnational crime in approximately half the targets (29 of 59). Illustrative examples are provided in Figure 6.

Figure 6. Instances Where the Potential Contravention was Unclear in Targets

[***Figure revised to remove privileged or injurious information. It described two examples of targets where the potential was unclear based on the details of the target.***]

Why is precision in record keeping important?

It is important to ensure that the potential contravention at issue is clear in scenario templates and targets and to ensure that recordkeeping about the reasons animating Flight List Targeting triaging is adequate in order to allow effective verification that all triaging activities comply with statutory and regulatory restrictions.

The CBSA’s current oversight functions consist of reviewing new scenarios prior to and in parallel with their activation and of reviewing targets after the fact for quality control and performance measurement. However, the documentation weaknesses identified above prevent the CBSA from ensuring that its triaging activities comply with statutory and regulatory restrictions. The CBSA’s oversight mechanisms should include robust verification that scenarios and manual Flight List Targeting triaging practices are animated by issues relevant to the administration or enforcement of the CBSA’s program legislation. Where Passenger Name Record data is used, oversight should also verify that the enforcement issue constitutes or is indicative of a terrorism offence or serious transnational crime. More precise and consistent recordkeeping of the reasons underlying passenger triage decisions in both Scenario Based Targeting and Flight List Targeting would help in this respect.

Guidance on what the legislative and regulatory restrictions entail for targeting activities was also not clearly articulated in the National Targeting Centre’s policies, standard operating procedures, or training materials. These guidance materials should include further specifics on:

  • Which issues pertinent to admissibility under the Immigration and Refugee Protection Act or other contraventions of the CBSA’s program legislation constitute or relate to a serious transnational crime or terrorism offence and why; and
  • How to document triaging decisions on a consistent basis to enable internal and external verification that targeting activities align with these legal and regulatory restrictions.

For example, the Scenario Based Targeting Governance Framework included helpful examples of risk categories that identify associated legislative provisions. Though the examples align with the definitions of serious transnational crime and terrorism offences in the Protection of Passenger Information Regulations, no explanation linking the examples to alignment with the regulations are provided. Equivalent guidance does not exist for Flight List Targeting.

Clearly identifying the potential enforcement issue is also important to verifying that the indicators created from Advance Passenger Information and Passenger Name Record data that are used to triage passengers are relevant to the issue and reliably predictive of it. This is important for demonstrating that the triaging practices are reasonable and non-discriminatory (see Section 6.3).

Finding 1. The CBSA’s use of Advance Passenger Information and Passenger Name Record data in Scenario Based Targeting complied with section 107(3) of the Customs Act.

Finding 2. The CBSA does not document its triaging practices in a manner that enables effective verification of whether all triaging decisions comply with statutory and regulatory restrictions.

Recommendation 1. NSIRA recommends that the CBSA document its triaging practices in a manner that enables effective verification of whether all triaging decisions comply with statutory and regulatory restrictions.

The CBSA’s Compliance with Obligations Pertaining to Non-Discrimination

The CBSA’s Non-Discrimination Obligations and Why They Matter

The Canadian Human Rights Act and the Charter each establish obligations pertaining to nondiscrimination. The tests for assessing whether or not discrimination has occurred are thematically similar, though with differences in approach and terminology as illustrated in Figure 7. The analysis under both instruments begins with a factual inquiry into whether a distinction is being drawn between travellers based on prohibited grounds of discrimination, and if so, whether it has an adverse effect on the traveller or reinforces, perpetuates or exacerbates disadvantage. If so, the analysis under the CHRA examines whether there is a bona fide justification for the adverse differentiation. The corresponding analysis under the Charter examines whether the limit on travellers’ equality rights is demonstrably justified in a free and democratic society.

Figure 7: Legal Tests under the CHRA and the Charter diagram

What NSIRA Found

Although triaging in Air Passenger Targeting typically relies on multiple indicators that are created from Advance Passenger Information and Passenger Name Record data, some of these indicators are protected grounds or relate closely to protected grounds. Air Passenger Targeting triaging results in impacts on travellers that can be considered adverse in nature and are capable of reinforcing, perpetuating, or exacerbating disadvantages. This creates a risk of prima facie discrimination. While these limits on travellers’ equality rights may be justifiable, weaknesses in the CBSA’s program documentation prevented the CBSA from demonstrating that a bona fide justification supported the adverse differentiation of travellers in several instances. A large body of information and intelligence is available to CBSA staff; however, it was not compiled and documented in a way that consistently established why certain indicators used to triage passengers related to a threat or potential contravention and did not always establish that these indicators were current and reliable. This weakness with respect to ensuring precise, well-substantiated documentation is similar to the one already highlighted in relation to the CBSA’s compliance with legal and regulatory restrictions.

Further information on the nature of the differentiations made in Air Passenger Targeting triaging practices and their impact on individuals would be required to conclusively establish whether or not triaging practices are discriminatory. However, the risk of discrimination is sufficiently apparent to warrant careful attention. In this review, NSIRA will recommend measures that could help the CBSA to assess and mitigate discrimination-related risks.

Does the CBSA make a distinction in relation to “protected grounds”?

Some of the indicators relied on to triage passengers are either protected grounds themselves or relate closely to protected grounds. NSIRA observed instances where passengers appeared to be differentiated based on protected grounds.

NSIRA examined all scenarios that were active on May 26, 2021 and a sample of targets to determine whether the CBSA’s triaging practices engage prohibited grounds of discrimination, such as age, sex, or national or ethnic origin. NSIRA refers to these as “protected grounds” in the report. The assessment considered:

  • How the indicators used to triage passengers relate to protected grounds;
  • The significance of the indicators in triage and how individual indicators were weighted in relation to each other; and
  • Whether these indicators created distinctions among individuals, or classes of individuals, based on protected grounds, whether in their own right or by virtue of their cumulative impact.

NSIRA found that the CBSA triages passengers based on a combination of indicators that are created from Advance Passenger Information and Passenger Name Record data. This triaging often included indicators that were either protected grounds themselves or related closely to protected grounds. Examples of these indicators are provided in Figure 8 with further details on how the CBSA relied on these indicators in Appendix 8.4.

Figure 8. Advance Passenger Information and Passenger Name Record Data That Relate to Protected Grounds
Figure 8: Diagram/Table of the Advance Passenger Information and Passenger Name Record Data That Relate to Protected Grounds

Although the CBSA took certain measures to mitigate the possibility that triaging decisions were based primarily on protected grounds, NSIRA observed that these measures did not always adequately mitigate that risk. More specifically:

  • [***Note revised to remove injurious or privileged information. It lists examples of scenarios that relied on single elements.***] NSIRA observed instances where scenarios continued to rely largely on indicators that related closely to protected grounds. This was because the behavioural indicators were often used in a way that related closely to a protected ground (primarily national origin) or because the parameters for the behavioural indicators were very broad (for example: passports as a travel document) and did not significantly narrow the range of passengers captured by the scenario. Examples are provided in Figure 9.
  • Scenario Based Targeting triaging for potential contraventions relevant to national security focused disproportionately on a certain profile of passengers: [***Sentence revised to remove injurious or privileged information. It described a combination of traveller characteristics that relates to protected grounds.***] While individual scenarios considered a variety of other indicators that differed between each scenario and that appeared to be specific to a unique set of personal characteristics and behavioural patterns for each national security risk, the overall effect of the scenarios created a differential impact largely focused on this particular profile.
Figure 9. Instances Where Behavioural Indicators Were Protected Grounds or Did Not Narrow Scope

[***Figure revised to remove privileged or injurious information. It describes two examples of scenarios where behavioural indicators were used in a way that related closely to a protected ground or because the parameters for the behavioural indicators were very broad and did not significantly narrow the range of passengers captured by the scenario***]

As the CBSA’s triaging practices engage protected grounds and resulted in a differentiation of passengers based on protected grounds in certain instances, NSIRA considered the impacts that these distinctions may produce.

Do distinctions result in adverse impacts capable of reinforcing, perpetuating, or exacerbating a disadvantage?

Distinctions made in passenger triage lead to several types of potential impacts for the passengers that are selected for further assessment. These impacts are adverse in nature and are capable of reinforcing, perpetuating, or exacerbating disadvantages.

NSIRA considered the kinds of impacts that Air Passenger Targeting has for the passengers who are selected for further assessment through the initial triage. These impacts are illustrated in Figure 10. Each may have important effects on passengers’ time, privacy, and equality, particularly as the impacts accumulate during the screening process and/or where these impacts are experienced repeatedly by the same travellers.

Figure 10. Impacts on Travellers Resulting from Initial Triage
Figure 10. Impacts on Travellers Resulting from Initial Triage diagram

[Figure revised to remove privileged or injurious information. It describes numbers of passengers targeted by year.]

These impacts can be adverse in nature and are reasonably understood as being capable of reinforcing, perpetuating, or exacerbating disadvantage, particularly when viewed in light of possible systemic or historical disadvantages. However, disaggregated data on the ethno-cultural, gender, or other group identity of affected passengers and their circumstances in Canadian society would be required to fully appreciate Air Passenger Targeting’s impacts on affected groups.

A risk of prima facie discrimination is established where these adverse impacts accrue to individuals based on protected grounds. These adverse impacts on protected groups will not amount to discrimination under the Canadian Human Rights Act if the CBSA can demonstrate a bona fide justification for the differentiation and will be allowed under the Charter if the CBSA can establish that the distinctions are a reasonable limit on travellers’ equality rights.

Does the CBSA have an adequate justification for the adverse differentiation?

While a large body of information and intelligence is available to CBSA’s staff for their triaging activities, weaknesses in recordkeeping, in the coherent synthesis of this information, and in data collection prevented the CBSA from demonstrating, that an adequate justification exists for its use of the indicators it created from Advance Passenger Information and Passenger Name Record data in several instances.

NSIRA examined how the CBSA relied on information and intelligence to support its triaging practices by reviewing a sample of 12 scenarios and a sample of 59 targets issued subsequent to manual triaging in Flight List Targeting. NSIRA also examined performance data for the selected scenarios. In examining the supporting documentation provided for each scenario demonstrated an adequate justification for the indicators created from Advance Passenger Information and Passenger Name Record data to triage passengers, NSIRA considered a number of factors:

  • Whether the information was objective and empirical;
  • Whether it was credible and reliable, in terms of its source and the quality of its substantiation;
  • Whether the information was recent and up to date;
  • Whether the information established a meaningful connection between the indicator(s) and the enforcement issue;
  • Whether the indicators were specifically indicative of the enforcement issue or were general;
  • Whether the indicators were based on a representative sample size; and
  • Whether the reliance on the particular indicators to triage passengers was effective in identifying potential contraventions in the past (i.e. whether empirical results support the reliance).

In Scenario Based Targeting, 11 out of the 12 scenarios in the sample reviewed did not provide an adequate justification for the triaging indicators, due in part to weaknesses in the supporting documentation for scenarios.

A summary of NSIRA’s assessment in relation to each of the assessment criteria is provided in Figure 11 and examples are described below.

Figure 11. Summary of NSIRA’s Assessment of Scenario Supporting Documentation
Figure 11: Graph/Table of the summary of NSIRA’s Assessment of Scenario Supporting Documentation

Most of the supporting documentation for the scenario sample was based on empirical information about enforcement actions or other intelligence products developed by the CBSA or its partners that were derived from clearly identified empirical sources. NSIRA considered these products to be objective and reliable sources. However, NSIRA noted three instances where it was unclear what the basis of the information was, and therefore whether it was objective and credible.

Inconsistencies in how supporting documentation for scenarios was maintained created further challenges for verifying that scenarios were based on reliable and up-to-date information, as four of the scenarios examined relied on information that was more than five years old and the CBSA could not locate one or more documents cited as supporting documentation in nine of the scenarios. While deleting older information is appropriate if it is replaced with more recent information, doing so in absence of more recent supporting information may undermine the CBSA’s the ability to justify the basis of the scenario.

In 3 of 12 scenarios examined, it was unclear how the supporting documentation related to the potential contravention identified in the scenario, which prevented further analysis as to how the indicators created from Advance Passenger Information and Passenger Name Record data were meaningfully connected to the enforcement issue. In all except one of the 12 scenarios, the supporting documentation did not mention one or more of the indicators in the scenario, making it unclear what the basis was for relying on those indicators. A number of the unsubstantiated indicators in those scenarios related closely to protected grounds. Two examples are provided in Figure 12.

Figure 12. Examples of Weaknesses in Scenario Supporting Documentation

[***Figure revised to remove privileged or injurious information. It describes issues observed in the supporting documentation for two scenarios as examples. These concerned the reliability of speculative claims made in an op-ed that was used as supporting documentation for one scenario that did not provide a clear basis for the indicators relied on in the scenario, and lack of information related to one or more of the indicators in the other scenario.***]

In 11 of the 12 scenarios, the supporting documentation did not include enough information to assess whether the indicators in the scenarios were based on a representative sample size of passengers. This prevented verification that the indicators in the scenario and their parameters reflect a pattern or trend in traveller characteristics and travel patterns rather than a single instance or handful of instances. Deriving indicators from too small a sample size also creates a risk that the indicators are not reliably associated to a potential contravention but rather simply connoted individuals who happen to have been the subject of past enforcement activity. A small sample size can also create bias and confirmation bias about stereotypes pertaining to traveller behaviour or personal characteristics.

Lack of information in 11 of the 12 scenarios on the likelihood and impact of the risk posed by the enforcement issue also prevented further assessment of the extent that the indicators and parameters were unique to the particular enforcement issue either individually or collectively. Moreover, in 4 of the 12 scenarios, the supporting documentation did not include any information to indicate that the indicators and parameters of the scenario had indeed been associated with a confirmed contravention of the CBSA’s program legislation or whether the association between the indicators and the enforcement issue was simply hypothetical. While reliable intelligence could also provide an empirical basis for passenger triage to inform the development of scenarios, information about whether scenarios have actually resulted in confirmed contraventions of the CBSA’s program legislation can be integrated into the supporting documentation of scenarios over time. This issue is examined further in relation to performance data below.

Only one of the 12 scenarios in the sample had enough information to get a sense of the enforcement issue, to understand the basis for relying on the particular indicators in the scenario in relation to the enforcement issue, and to establish that the indicators were based on a clear pattern of association with a large number of confirmed contraventions and reflected an appropriate range. Details about this scenario and why the supporting document substantiated the scenario are provided in Figure 13.

[***Figure revised to remove privileged or injurious information. It describes how the supporting documentation provided for a scenario was based on credible, empirical information that helped to establish the enforcement issue, provided a sense of the prevalence of the issue and its pertinence to the CBSA mandate, established a correlation between the specific indicators in the scenario and confirmed contraventions based on a significant sample size, and established that the parameters for each indicator were appropriately defined.***]

A large body of information and intelligence is available to CBSA staff to inform their targeting activities; however, in all except one of the scenarios, the information, intelligence, and other analytical insights were not brought together coherently to demonstrate that the basis for triaging was justified in those particular instances. The CBSA indicated that they intend to prepare standardized intelligence products that would coherently bring together this information to support the development of new scenarios. Developing such products for all active scenarios would help ensure that an adequate justification exists for all differentiation arising from triaging decisions in Air Passenger Targeting. This issue is examined further in relation to oversight practices below.

In Flight List Targeting, there was insufficient documentation to explain why particular indicators were considered valid risk factors in the context of a particular enforcement issue.

While a large body of information and intelligence exists for Targeting Officers to draw from when triaging passengers in Flight List Targeting, these sources are not necessarily documented in the course of making triaging decisions. Flight List Targeting strategies are not codified and triaging decisions are not consistently documented. This means that the sources and considerations that informed individual triaging decisions were not always apparent in the program documentation that NSIRA reviewed.

Noting the limitations of analyzing targets for insight into initial triaging decisions mentioned previously, the sparse details contained within the sample of 59 targets issued subsequent to Flight List Targeting further limited NSIRA’s assessment. Most of the targets included information specific to each passenger that was obtained through the passenger risk assessment, which reasonably supported a justification for issuing the target. However, this information would have been obtained after initial triaging decisions. Targets occasionally included a brief explanation about why certain elements of Advance Passenger Information and Passenger Name Record data were considered to be risk factors, suggesting that the Targeting Officer’s triage decision may have been informed by information and intelligence. However, it was often unclear why the passenger data cited as risk factors in the target suggested a threat or potential contravention of the CBSA’s program legislation. Assessing how the passenger data cited as risk factors in a target corresponded with the potential contravention was further complicated where the enforcement issue was also unclear. Examples in Figure 14 illustrate this challenge.

Figure 14. Why the Justification for the Indicators Used in Targeting is Important

[***Figure revised to remove privileged or injurious information. It returns to the examples of targets discussed in Figure 6 where ambiguity about the enforcement issue created further challenges for assessing how the passenger data cited as risk factors in the target corresponded with the enforcement issue.***]

Performance data for the scenario sample indicates that the indicators created from Advance Passenger Information and Passenger Name Record data to triage passengers may not be closely correlated with the particular enforcement issue.

The CBSA should be able to demonstrate at the outset that information and intelligence justify the use of particular indicators created from Advance Passenger Information and Passenger Name Record data to triage passengers for potential contraventions, particularly where those indicators relate to protected grounds. However, secondary examination results from previously issued targets can provide a source of such information. These results also provide important insight into how strongly certain indicators correlate with potential contraventions and indicate areas where inferences should be revisited and revised.

NSIRA’s analysis of the performance data for the sample of 12 scenarios revealed that the indicators may not necessarily be closely correlated with the particular enforcement issue(s) in the scenarios or predict potential contraventions of the CBSA’s program legislation with high accuracy.

  • In many of the scenarios, less than 5 percent of passengers that matched to the scenario—based on their Advance Passenger Information and Passenger Name Record data—resulted in an enforcement action or relevant intelligence at the end of a secondary examination, which the CBSA refers to as a “resultant” target. This is due in part to the fact that the vast majority of passengers who are risk assessed do not result in a decision to issue a target. Additionally, certain enforcement issues may have a low probability of occurring, but a high impact. However, the fact that most passengers who match to a scenario are not of concern raises questions about the accuracy of relying on Advance Passenger Information and Passenger Name Record data elements as indicators and about the proportionality of the targeting practices.
  • On average, a quarter of targets issued (through both Flight List Targeting and Scenario Based Targeting) led to a “resultant” secondary examination, though the scenarios in the sample ranged widely from as low as 4.8 percent to as high as 72.7 percent.
  • Only nine of the 12 scenarios led to at least one enforcement action or useful intelligence between 2019-20 or 2020-21. Again, this is not necessarily an issue if an enforcement issue has a low probability of occurring, but a high impact. However, it also raises questions about the empirical basis of the scenario.
  • Many of the scenarios led to examination results for issues other than the one that justified the initial targeting. This suggests that the indicators may not be very precise and raises questions about the underlying assumptions or inferences.

NSIRA also observed that the performance data for scenarios matched to a significantly higher proportion of travellers and yielded a higher proportion of “resultant” targets in one year, with much lower results in the next year, indicating how rapidly travel patterns may change. The CBSA indicated that COVID-19 resulted in major shift in travel and business patterns, which has presented challenges for the CBSA to understand how the indicators have evolved in relation to a diversity of enforcement issues and to adapt their targeting strategies. This emphasizes the importance of ensuring that scenarios and Flight List Targeting activities are supported by up-to-date information and intelligence. It also emphasizes the importance of analyzing performance data to rigorously to evaluate, refine, and/or deactivate scenarios in order to remain consistent with a changing risk environment.

However, the insights that can be drawn from the performance data are limited, because the CSBA does not track the results of secondary examinations arising from random referrals or instances where passengers that were not targeted were later found to have contravened the CBSA’s program legislation by other means. This prevents contextualization of Air Passenger Targeting performance against a baseline (namely, whether Air Passenger Targeting is better, on par with, or less effective at predicting a potential contravention of its program legislation than a random referral). Beyond its relevance for performance measurement, baseline data would help to protect the CBSA against confirmation biases where enforcement results in a few isolated cases may reinforce stereotypes even though they do not represent a meaningful trend. Moreover, a “resultant” secondary examination according to the National Targeting Centre’s definition does not necessarily indicate a confirmed instance of non-compliance. This makes it difficult to analyze performance data as source of empirical information to support the CBSA’s justification for using certain indicators to triage passengers, as a “resultant” search may not always signify a correlation between the indicators and the potential contravention.

In sum, the CBSA was not able to demonstrate that adequate justification consistently supported its use of particular indicators in the scenarios and targets examined by NSIRA. This creates a risk that the triaging activities were discriminatory. To avoid discrimination, the link between the indicators used to triage passengers and the potential threats and contraventions they purport to identify must be well-substantiated by recent, reliable, and documented intelligence or empirical information that demonstrates that the indicators are reasonably predictive of potential harms to Canada’s national security and public safety. The CBSA was able to document an adequate justification for passenger triaging in one scenario. Compiling relevant information and intelligence for its other triaging activities would assist in demonstrating that they are also non-discriminatory.

Further information would be required to determine if any distinctions arising from Air Passenger Targeting that are capable of reinforcing, perpetuating, or exacerbating a disadvantage constitute a reasonable limit on travellers’ equality rights.

The analysis above establishes that Air Passenger Targeting may infringe travellers’ equality rights under the Charter. All Charter rights are subject to reasonable limits, however. To establish that a limit is reasonable, the state must demonstrate that it is rationally connected to a pressing and substantial objective, that it is minimally impairing of the right, and that there is a proportionality between its salutary and deleterious effects. These limits must also be prescribed by law.

The analysis of whether state actions constitute a reasonable limitation of Charter rights is highly fact specific. To examine this question, further data would be required on:

  • Precisely how various indicators relate to protected grounds;
  • Whether the indicators effectively further national security and public safety;
  • The reasonable availability of other means to ensure similar security outcomes at the border;
  • The impacts of Air Passenger Targeting for affected passengers; and
  • The significance of the contribution of Air Passenger Targeting to national security and other government objectives.

NSIRA notes these data gaps may create challenges for the CBSA in establishing that any discrimination resulting from Air Passenger Targeting is demonstrably justified under section 1 of the Charter. Documenting the contribution of Air Passenger Targeting to national security and public safety, the breadth and nature of its impacts, and contrasting the effectiveness of Air Passenger Targeting relative to other less intrusive means of achieving the CBSA’s objectives would assist the CBSA in demonstrating that the program is reasonable and demonstrably justified in Canadian society.

Has the CBSA complied with its obligations pertaining to non-discrimination?

Air Passenger Targeting triaging practices create a risk of prima facie discrimination. This is due to two key features. First, Air Passenger Targeting relies, in part, on indicators created from Advance Passenger Information and Passenger Name Record data that are either protected grounds themselves or that relate closely to such grounds. This was particularly the case for indicators relating to passengers’ age, sex, and national or ethnic origin. Passengers were differentiated based on these grounds, as they were selected for further assessment due in part to these characteristics. NSIRA also observed that the triaging resulted in disproportionate attention to certain nationalities and sexes, when the cumulative effect of scenarios was taken into account.

Second, this differentiation has adverse effects on travellers. Air Passenger Targeting triaging affects individuals’ privacy through subsequent risk assessments and mandatory referrals for secondary examination. Such scrutiny may also erode an individual’s sense of receiving the equal protection of the law, particularly where these impacts are repeatedly experienced by the same traveller or are perceived to be animated by racial, religious, ethnic, or other biases. These impacts are also capable of reinforcing, perpetuating, or exacerbating disadvantage, especially when viewed in light of systemic or historical disadvantage.

To comply with its obligations under the Canadian Human Rights Act, the CBSA must be able to demonstrate that a bona fide justification exists for this adverse differentiation. However, the CBSA was not able to demonstrate that its choice of indicators was consistently based on recent, reliable, and documented intelligence or empirical information. This weaknesses in the link between the indicators and the potential threats or contraventions they seek to identify, creates a risk of discrimination.

To comply with its Charter obligations, the CBSA must also be able to demonstrate that any resulting discrimination is a reasonable limit on travellers’ equality rights. The same weaknesses NSIRA observed in the CBSA’s substantiation of the link between particular indicators and potential threats or contraventions they seek to identify also undermines its ability to demonstrate the rational connection between its triaging indicators and potential contraventions of its program legislation. Further information on the contribution of Air Passenger Targeting to national security and its relative value compared to other screening means would also be needed to determine whether Air Passenger Targeting can be justified as a reasonable limit under the Charter.

The weaknesses NSIRA observed stem partly from lack of precision in the CBSA’s program documentation and other recordkeeping issues. These are examined in the following section.

Finding 3. The CBSA has not consistently demonstrated that an adequate justification exists for its Air Passenger Targeting triaging practices. This weakness in the link between the indicators used to triage passengers and the potential threats or contraventions they seek to identify creates a risk that Air Passenger Targeting triaging practices may be discriminatory.

Recommendation 2. NSIRA recommends that the CBSA ensure, in an ongoing manner, that its triaging practices are based on information and/or intelligence that justifies the use of each indicator. This justification should be well-documented to enable effective internal and external verification of whether the CBSA’s triaging practices comply with its non-discrimination obligations.

Recommendation 3. NSIRA recommends that the CBSA ensure that any Air Passenger Targeting-related distinctions on protected grounds that are capable of reinforcing, perpetuating, or exacerbating a disadvantage constitute a reasonable limit on travellers’ equality rights under the Charter.

What measures are in place to mitigate the risk of discrimination?

The policies, procedures, and training materials reviewed did not adequately equip CBSA staff to identify potential discrimination or to mitigate related risks in the exercise of their duties.

The CBSA’s Air Passenger Targeting policies acknowledged responsibility to respect privacy, human rights, and civil liberties. However, policies, procedures, and training were insufficiently detailed to equip staff to identify and mitigate discrimination-related risks in the exercise of their duties.

  • Targeting Officers did not receive any specific training related to human rights.
  • The CBSA’s policies, procedures, and other program guidance were not precise enough on specific requirements or steps to equip staff to mitigate risks related to discrimination. In particular, details were lacking in how to associate supporting documentation to a scenario or a triaging decision in Flight List Targeting, and when and how to revisit and update that information on are gular basis.
  • No specific policies, procedures, or guidelines were developed for Flight List Targeting beyond the Air Passenger Targeting Standard Operating Procedures, particularly those that relate to record keeping.

The oversight structures and practices that were reviewed were not rigorous enough to identify and mitigate potential discrimination-risks, compounded by an absence of relevant data for this task.

While the CBSA has oversight structures and practices in place for Air Passenger Targeting, it was unclear how these oversight practices were performed. NSIRA identified several areas where they may not be rigorous enough to identify and mitigate potential risks of discrimination as appropriate.

  • Scenarios are reviewed for policy, legal, privacy, human rights, and civil liberties implications as part of their activation and on an ongoing basis. However, it is not clear that these oversight functions are guided by a clear understanding of what constitutes discrimination or that all relevant aspects of scenarios are examined.
  • Scenarios are reviewed individually on a regular basis. However, it is not clear that the collective impact of the CBSA’s targeting activities is also assessed on a regular basis.
  • It is not clear whether any oversight functions related to non-discrimination take place in Flight List Targeting.

Moreover, the CBSA does not gather data relevant to fully assess whether Air Passenger Targeting results in discrimination or to mitigate its impacts.

  • The CBSA does not gather disaggregated demographic data about the passengers affected by each stage of the Air Passenger Targeting program. This is relevant to detecting whether the program may be drawing distinctions on protected grounds and/or whether it has a disproportionate impact on members of protected groups.
  • The CBSA does not compare information about its triaging practices against information relevant to understanding their potential impacts on travellers and whether those impacts indicate an issue with the CBSA’s targeting practices. This includes information about whether complaints about alleged discrimination at the border relate to a person identified through Air Passenger Targeting and whether the nature of secondary examinations resulting from Air Passenger Targeting may differ from those caused by random or other referrals.
  • The CBSA does not gather or assess relevant performance data or data on its impacts against a baseline comparator group in order to contextualize its analysis of this information.

Finding 4. The CBSA’s policies, procedures, and training are insufficiently detailed to adequately equip CBSA staff to identify potential discrimination-related risks and to take appropriate action to mitigate these risks in the exercise of their duties.

Finding 5. The CBSA’s oversight structures and practices are not rigorous enough to identify and mitigate potential discrimination-related risks, as appropriate. This is compounded by a lack of collection and assessment of relevant data.

A number of adjustments to current policies, procedures, guidance, training, and other oversight practices for the Air Passenger Targeting program will help the CBSA mitigate discrimination-related risks by ensuring that distinctions drawn in the initial triage of passengers are based on adequate justifications that are supported by intelligence and/or empirical information. A more detailed treatment on discrimination in training, policies, guidance materials, and oversight for the Air Passenger Targeting program could also provide CSBA staff and the units and committees that perform internal oversight functions with information they may require to exercise their functions accordingly. Careful attention should be paid to the following:

  • Understanding the CBSA’s human rights obligations and how risks related to discrimination should be identified and assessed;
  • Identifying when triaging indicators may relate to protected grounds;
  • Ensuring that any adverse differentiation is based on a well-substantiated connection between the indicators and the potential threat or potential contravention;
  • Ensuring the triage of travellers is informed by recent and reliable information and intelligence, with training on how to assess whether the supporting documents meets these requirements;
  • Identifying and addressing impacts resulting from passenger triaging practices to ensure that they are minimized and proportional to the benefit gained for public safety or national security;
  • Ensuring that impacts resulting from Air Passenger Targeting do not unduly reinforce, perpetuate, or exacerbate disadvantage; and
  • Developing tools to detect and mitigate potential biases by gathering and assessing relevant data on targeting practices, their performance, and their impacts.

In this respect, the obligations created by the United Kingdom Public Sector Equality Duty may be instructive. The duty is procedural in nature and requires that public bodies (including customs and immigration authorities) consider how they may eliminate discrimination in the exercise of their functions. It requires departments to turn their minds to the potential impact their decisions, policies or programs have, and how these may differ based on protected grounds, such as age, sex/gender, and race, ethnic or national origin, colour, or nationality. It also creates an obligation to acquire relevant information, if it is not already available, to avoid direct or indirect discrimination.

It is important to clarify that any data collection and analysis relevant to detecting and addressing potential discrimination should be conducted by a separate unit than the National Targeting Centre. Targeting Officers should not have access to disaggregated demographic data when triaging passengers, as this might increase discrimination-related risks. The CBSA recognizes this in its commitment to removing “sensitive data” about a person’s health or sex life from the Advance Passenger Information and Passenger Name Record data that it imports into its triaging systems. This precaution should not prevent other units within the CBSA from gathering and considering depersonalized, disaggregated demographic data, including to conduct Gender Based Analysis+ that could reduce the risk of discrimination and/or mitigate its potential impacts.

Recommendation 4. NSIRA recommends that the CBSA develop more robust and regular oversight for Air Passenger Targeting to ensure that its practices are not discriminatory. This should include updates to the CBSA’s policies, procedures, training, and other guidance, as appropriate.

Recommendation 5. NSIRA recommends that the CBSA start gathering and assessing the necessary data to identify, analyze, and mitigate discrimination-related risks. This includes disaggregated demographic data, data on the effects of Air Passenger Targeting on secondary examinations that may be apparent from related human rights complaints, and data on a baseline comparator group.

Conclusion

The pre-arrival risk assessments performed as part of the CBSA’s Air Passenger Targeting program support the CBSA’s ability to screen inbound travellers in relation to a variety of enforcement issues. However, some of the information used to triage passengers relates to protected grounds. This creates a risk that passengers may be differentiated based on prohibited grounds of discrimination. Triaging may lead to adverse impacts on passengers’ time, privacy, and equal treatment, which maybe capable of reinforcing, perpetuating or exacerbating disadvantage.

Careful attention to the reliability of the information and intelligence that underpin the choice of indicators to triage passengers and their connection to the threats or potential contraventions they seek to identify is needed to verify that the CBSA respects its non-discrimination obligations. This has implications for both Canada’s national security and its international commitments related to combatting terrorism and serious transnational crime and related to privacy and human rights.

NSIRA is satisfied that the CBSA has the legal authority to conduct Air Passenger Targeting. However, NSIRA observed shortcomings in the CBSA’s documentation of its program activities that complicated verification that all triaging decisions complied with statutory and regulatory restrictions. Improvements to documentation in these respects are essential and will help lower future compliance risks by ensuring the CBSA can verify that all triaging decisions comply with the terms of the Customs Act and the Protection of Passenger Information Regulations.

Similarly, the absence of adequate justification in several instances for the CBSA’s reliance on indicators created from passengers’ Advance Passenger Information and Passenger Name Record data leads to a risk of discrimination. Improving documentation requirements and setting out further detail in the CBSA’s policies, procedures, and training would better equip CBSA staff to understand these risks and mitigate them in the conduct of their duties. More robust and regular oversight to ensure that adequate justification exists for any adverse differentiation arising from Air Passenger Targeting grounds would equip the CBSA to identify which scenarios or manual Flight List Targeting triaging practices need further support. Improving relevant data gathering and assessment will also support the identification and mitigation of discrimination-related risks in Air Passenger Targeting.

Appendices

Findings & Recommendations

Findings Recommendations
Finding 1. The CBSA’s use of Advance Passenger Information and Passenger Name Record data in Scenario Based Targeting complied with section 107(3) of the Customs Act. Recommendation 1. NSIRA recommends that the CBSA document its triaging practices in a manner that enables effective verification of whether all triaging decisions comply with statutory and regulatory restrictions.
Finding 2. The CBSA does not document its triaging practices in a manner that enables effective verification of whether all triaging decisions comply with statutory and regulatory restrictions. Recommendation 2. NSIRA recommends that the CBSA ensure, in an ongoing manner, that its triaging practices are based on information and/or intelligence that justifies the use of each indicator. This justification should be well-documented to enable effective internal and external verification of whether the CBSA’s triaging practices comply with its non-discrimination obligations.
Finding 3. The CBSA has not consistently demonstrated that an adequate justification exists for its Air Passenger Targeting triaging practices. This weakness in the link between the indicators used to triage passengers and the potential threats or contraventions they seek to identify creates a risk that Air Passenger Targeting triaging practices may be discriminatory. Recommendation 3. NSIRA recommends that the CBSA ensure that any Air Passenger Targetingrelated distinctions on protected grounds that are capable of reinforcing, perpetuating, or exacerbating a disadvantage constitute a reasonable limit on travellers’ equality rights under the Charter.
Finding 4. The CBSA’s policies, procedures, and training are insufficiently detailed to adequately equip CBSA staff to identify potential discrimination-related risks and to take appropriate action to mitigate these risks in the exercise of their duties. Recommendation 4. NSIRA recommends that the CBSA develop more robust and regular oversight for Air Passenger Targeting to ensure that its practices are not discriminatory. This should include updates to the CBSA’s policies, procedures, training, and other guidance, as appropriate.
Finding 5. The CBSA’s oversight structures and practices are not rigorous enough to identify and mitigate potential discrimination-related risks, as appropriate. This is compounded by a lack of collection and assessment of relevant data. Recommendation 5. NSIRA recommends that the CBSA start gathering and assessing the necessary data to identify, analyze, and mitigate discrimination-related risks. This includes disaggregated demographic data, data on the effects of Air Passenger Targeting on secondary examinations that may be apparent from related human rights complaints, and data on a baseline comparator group.

The CBSA’s Authority to Collect and Use Advance Passenger Information and Passenger Name Record data in Air Passenger Targeting

Authority to Collect the Data
Customs Act, s. 107.1 & IRPA s. 148(1)(d) Air carriers are required to provide “prescribed information” about any person on board, or expected to be on board, a flight arriving into Canada.
Passenger Information Customs Regulations, s. 5 & Immigration and Refugee Protection Regulations, s. 269(1) Prescribe the required information, which constitute Advance Passenger Information and Passenger Name Record data.
Authority to Use the Data
Customs Act, s. 107(3) “Customs information” (including Advance Passenger Information/Passenger Name Record data)115 may be used for three purposes:
• Administer or enforce the Customs Act, Customs Tariff, or related legislation;
• Exercise the powers or perform the duties and functions of the Minister of Public Safety under the IRPA, including establishing a person’s identity or determining their inadmissibility;
• For the purposes of other program legislation that the Minister of Public Safety or the CBSA is authorized to enforce
Immigration and Refugee Protection Act, s.149(a) Advanced Passenger Information and Passenger Name Record data may be used for three purposes:
• for the purposes of the IRPA;
• for the purposes of the Department of Citizenship and Immigration Act;
• to identify a person for whom a warrant of arrest has been issued in Canada.
Protection of Passenger Information Regulations, s. 4 Passenger Name Record data provided to the CBSA under the Immigration and Refugee Protection Act116 may be used for two purposes:
• to identify persons who have or may have committed a terrorism offence or serious transnational crime;
• to conduct a trend analysis or develop risk indicators for that purpose.

Frequently Cited Provisions in Scenario Templates

The figure summarizes the main provisions cited as potential contraventions in scenario templates. [***Sentence revised to remove privileged or injurious information. It describes the number of scenarios that were active on May 26, 2021***]. Five of the provisions that were cited as potential contraventions did not clearly establish a link to a serious transnational crime or terrorism offence in compliance with the Protection of Passenger Information Regulations (PPIR). These are marked in orange and described below.

Provisions Description Complies with Cust Act Complies with PPIR
IRPA s. 20 Presenting visa or other documents Yes Yes*
IRPA s. 34 Inadmissible, national security reasons Yes Yes
IRPA s. 35 Inadmissible, human rights violations Yes Yes
IRPA s. 36 Inadmissible, serious criminality Yes Yes
IRPA s. 37 Inadmissible, organized criminality Yes Yes
IRPA s. 40 Inadmissible, misrepresentation Yes Yes*
IRPA s. 41 Inadmissible, IRPA non-compliance Yes Yes*
IRPA s. 117 Human smuggling Yes Yes
IRPA s. 118 Human trafficking Yes Yes
Customs Act s. 159 Smuggling goods Yes Yes
Customs Act s. 12 Reporting goods Yes Yes*
Customs Act s. 13 Truthfully answering questions about & presenting goods Yes Yes*
Customs Tariff 9899.00.00 Hate or terrorist propaganda; seditious materials Yes Yes
PCMLTFA s. 12 Reporting of currency Yes Yes
PCMLTFA s. 74 General Offences Yes Yes

Section 20 of the Immigration and Refugee Protection Act (IRPA) concerns the requirement for foreign nationals to have the proper documentation to enter or remain in Canada. As contraventions of the IRPA where a penalty is not specified (such as section 20) are punishable by a term of imprisonment of up to two years under sections 124 and 125 of the IRPA, this contravention does not meet the definition of a serious transnational crime.

Section 40 of the IRPA indicates that a foreign national is inadmissible to Canada for misrepresentation. The link to serious transnational crime would be clearer by citing the provisions that establish misrepresentation as an offence under sections 127 and 128 of the IRPA.

Section 41 of the IRPA indicates that a foreign national is inadmissible for non-compliance with the IRPA. Non-compliance with the IRPA is not itself a terrorism offence or serious transnational crime. Further details about the enforcement concern are necessary to establish such a link.

Sections 12 and 13 of the Customs Act concern traveller requirements to report goods and truthfully answer questions; reference to the penalty provision in section 160(1)(b) indicates it is a serious offence. Reliance on these sections to justify the use of Passenger Name Record data may be problematic however, as these sections relate to future conduct, whereas section 4 of the PPIR focuses on past conduct (“have or may have” committed such acts). Concerns about prohibited goods or potential smuggling of goods may also more appropriately cite section 159 of the Customs Act and/or the Customs Tariff, Item 9899.00.00.

Examples of the CBSA’s Reliance on Indicators Relating to Protected Grounds

The figure below presents examples from both Scenario Based Targeting and Flight List Targeting of how the CBSA relies on indicators created from Advance Passenger Information and Passenger Name Record data that are or may relate closely to the grounds of “national or ethnic origin,” “age,” or “sex,” which are prohibited grounds of discrimination under the Canadian Human Rights Act and the Charter. The CBSA often relies on more than one such indicator. This is discussed in Section 6.2.2.1. The CBSA’s basis for relying on such indicators is discussed in Section 6.2.2.3.

[***Figure revised to remove injurious or privileged information. It provides statistics on the number of scenarios that rely on indicators that relate to protected grounds for “national or ethnic origin,” “age,” and “sex.”***]

Share this page
Date Modified:

Review of Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2020

Completed Reviews

Review of Departmental Implementation of the Avoiding Complicity in Mistreatment by Foreign Entities Act for 2020


Backgrounder

The Avoiding Complicity in Mistreatment by Foreign Entities Act (ACA or Act) and its associated directions seek to prevent the mistreatment of any individual as a result of information exchanged between a Government of Canada department and a foreign entity. At the heart of the directions is the consideration of substantial risk, and whether that risk, if present, can be mitigated. To do this, the Act and the directions lay out a series of requirements that need to be met or implemented when handling information. This review covers the implementation of the directions sent to 12 departments and agencies from their date of issuance, January 1, 2020, to the end of the previous calendar year, December 31, 2020. It was conducted under subsection 8(2.2) of the National Security and Intelligence Review Agency Act (NSIRA Act), which requires NSIRA to review, each calendar year, the implementation of all directions issued under ACA.

This was the first ACA review to cover a full calendar year. Many of the reviewed departments noted that the pandemic impacted their information sharing activities, thus impacting the number of cases requiring further review as per the ACA. As such, NISIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.

As part of the review, NSIRA examined the case triage process of all twelve departments. NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.

In keeping with NSIRA’s 2020 Annual Report which emphasized the implementation of a “trust but verify” approach for assessing information provided over the course of a review, NSIRA continues to work on various verification strategies with the Canadian intelligence community. However, due to the continuing COVID-19 pandemic, implementation of verification processes was not possible across all twelve departments which fall under the ACA. Notwithstanding, the information provided by departments has been independently verified by NSIRA through documentation analysis and meetings with department subject matter experts, as warranted. Further work is underway to continue developing an access model for the independent verification of information relevant to ACA considerations.

Date of Publishing:

Executive Summary

The Avoiding Complicity in Mistreatment by Foreign Entities Act (ACA or Act) and its associated directions seek to prevent the mistreatment of any individual as a result of information exchanged between a Government of Canada department and a foreign entity. At the heart of the directions is the consideration of substantial risk, and whether that risk, if present, can be mitigated. To do this, the Act and the directions lay out a series of requirements that need to be met or implemented when handling information. This review covers the implementation of the directions sent to 12 departments and agencies from their date of issuance, January 1, 2020, to the end of the previous calendar year, December 31, 2020. It was conducted under subsection 8(2.2) of the National Security and Intelligence Review Agency Act (NSIRA Act), which requires NSIRA to review, each calendar year, the implementation of all directions issued under ACA.

This was the first ACA review to cover a full calendar year. Many of the reviewed departments noted that the pandemic impacted their information sharing activities, thus impacting the number of cases requiring further review as per the ACA. As such, NISIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.

While NSIRA was pleased with the considerable efforts made by many departments new to ACA in building their frameworks, Canada Boarder Services Agency (CBSA) and Public Safety did not finalize their policy frameworks in support of the Directions received under the ACA for the review period.

As part of the review, NSIRA examined the case triage process of all twelve departments. NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.

A case sent to both GAC and CSIS was reviewed by NSIRA for its implications under the ACA. While the information was ultimately not shared with the requesting foreign entity, nonetheless, NSIRA found that the risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.

Mitigation measures used by departments were also reviewed this year, since they are an integral part in the information sharing process for departments. NSIRA observed that there are gaps in departments’ ability to verify whether a country or entity has actually complied with caveats or assurances because of the difficulty in tracking compliance to mitigation measures.

NSIRA believes that it is now in a position to conduct in-depth case study assessments of individual departments’ adherence to the ACA and Directions, irrespective of whether or not a department reported any cases to its deputy head. Finally, future reviews will follow up on the ongoing implementation of NSIRA’s past recommendations.

In keeping with NSIRA’s 2020 Annual Report which emphasized the implementation of a “trust but verify” approach for assessing information provided over the course of a review, NSIRA continues to work on various verification strategies with the Canadian intelligence community. However, due to the continuing COVID-19 pandemic, implementation of verification processes was not possible across all twelve departments which fall under the ACA. Notwithstanding, the information provided by departments has been independently verified by NSIRA through documentation analysis and meetings with department subject matter experts, as warranted. Further work is underway to continue developing an access model for the independent verification of information relevant to ACA considerations.

Authorities

This review was conducted under subsection 8(2.2) of the NSIRA Act, which requires NSIRA to review, each calendar year, the implementation of all directions issued under the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACA or the Act).

Introduction

Review background

Departments and agencies in the Government of Canada routinely share information with a range of foreign entities. However such practices can sometimes bring into play a risk of mistreatment for individuals who are the subjects of these exchanges or other individuals. It is therefore incumbent upon the Government of Canada to evaluate and mitigate the risks that this sharing entails.

In 2011, the Government of Canada implemented a general framework for Addressing Risks of Mistreatment in Sharing Information with Foreign Entities. The aim of the framework was to establish a coherent approach across government when sharing with and receiving information from foreign entities. Following this, Ministerial Direction was issued to applicable departments in 2011 (Information Sharing with Foreign Entities), and then again in 2017 (Avoiding Complicity in Mistreatment by Foreign Entities).

On July 13, 2019, the ACA came into force. The preamble of the Act recognizes Canada’s commitments with respect to the Canadian Charter of Rights and Freedoms, and Canada’s international legal obligations on prohibiting torture and other cruel and inhumane treatment. The Act also recognizes that information needs to be shared to enable the Government to fulfill its fundamental responsibility to protect Canada’s national security and the safety of Canadians.

On September 4, 2019, pursuant to section 3 of the ACA, the Governor in Council (GiC) issued written directions (Orders in Council (OiCs) or Directions) to the deputy heads of 12 departments and agencies. This added six new Canadian entities in addition to those that were already associated with the 2011 and 2017 Directions.

This report is NSIRA’s first full year assessment of the implementation of the Directions issued under ACA for the 2020 calendar year. The review builds upon two previous reviews conducted in respect of avoiding complicity in mistreatment. The first was in respect to the 2017 Ministerial Directions, while the second assessed the Directions issued under the ACA, but was limited to the four months from when the Directions were issued to the end of the 2019 calendar year.

ACA and Directions

The ACA and the Directions issued under its authority seek to prevent the mistreatment of any individual due to the exchange of information between a Government of Canada department or agency and a foreign entity. The Act and the Directions also aim to limit the use of information received from a foreign entity that is likely to have been obtained through the mistreatment of an individual.

Under the authority of subsection 3(1) of the Act, the Directions issued to the 12 departments and agencies are near identical in language and focus on the three aspects of handling information when interacting with a foreign entity: the disclosure of information, the requesting of information, and the use of any information received.

In regards to disclosure of information, the Directions state:

If the disclosure of information to a foreign entity would result in a substantial risk of mistreatment of an individual, the Deputy Head must ensure that the Department officials do not disclose the information unless the officials determine that the risk can be mitigated, such as through the use of caveats or assurances, and appropriate measures are taken to mitigate the risk.

With respect to requesting information, the Directions read as follows:

If the making of a request to a foreign entity for information would result in a substantial risk of mistreatment of an individual, the Deputy Head must ensure that Department officials do not make the request for information unless the officials determine that the risk can be mitigated, such as through the use of caveats or assurances, and appropriate measures are taken to mitigate the risk.

Lastly, as it relates to the use of information, the Directions provide:

The Deputy Head must ensure that information that is likely to have been obtained through the mistreatment of an individual by a foreign entity is not used by the Department
(a) in any way that creates a substantial risk of further mistreatment;
(b) as evidence in any judicial, administrative or other proceeding; or
(c) in any way that deprives someone of their rights or freedoms, unless the Deputy Head or, in exceptional circumstances, a senior official designated by the Deputy Head determines that the use of the information is necessary to prevent loss of life or significant personal injury and authorizes the use accordingly.

The consideration of substantial risk figures prominently in subsection 3(1) of the Act as well as the Directions. In considering whether to disclose or request information, a department must determine whether a substantial risk is present and if so whether it can be mitigated. As noted in the previous reviews on information sharing, the ACA does not define “substantial risk”. Departments refer to a definition of this term as set out in the 2017 Ministerial Directions as a general starting point when conducting assessments under the ACA. The 2017 Ministerial Directions define substantial risk as:

‘Substantial risk’ is a personal, present and foreseeable risk of mistreatment that is real and is based on something more than mere theory or speculation. In most cases, the test of a substantial risk of mistreatment would be satisfied when it is more likely than not there would be mistreatment; however, in some cases, particularly where the risk if of severe harm, the standard of substantial risk may be satisfied at a lower level of probability.

Based on the outcome of these determinations, the decision may be to approve, deny, or elevate to the Deputy Head for his or her consideration. Substantial risk is also contemplated in the consideration of the use of information received from a foreign entity. If it is evaluated that the information was likely obtained from the mistreatment of an individual, the department is prohibited from using the information in any way that creates a substantial risk of further mistreatment.

Throughout the process to determine whether to disclose or use information, the Directions require that the accuracy, reliability, and limitations of use of all information being handled are appropriately described and characterized.

Additionally, reporting requirements are found at sections 7 and 8 of the Act as well as within the Directions. Among these requirements, the Minister responsible for the department must provide a copy of the department’s annual report in respect of the implementation of the Directions during the previous calendar year as soon as feasible to NSIRA, the National Security and Intelligence Committee of Parliamentarians (NSICoP) and, if applicable, the Civilian Review and Complaints Commission (CRCC) for the Royal Canadian Mounted Police. Reporting requirements as articulated in the Directions oblige the reporting of decisions which were considered by the Deputy Head in regards to disclosure, requesting of information, or authorizing use of information that would deprive someone of their rights or freedoms be made as soon as feasible to the responsible Minister, NSIRA, and NSICoP.

Review Objectives and Methodology

The review period was January 1, 2020 to December 31, 2020. The objectives of this review included:

  • Following-up on departments’ implementation of the directives received under the ACA;
  • Assessing departments’ operationalization of frameworks/processes that enable them to meet the obligations set out in the ACA and directives; and
  • Assessing coordination and consistency in implementation across applicable departments.

Additionally, NSIRA evaluated all twelve ACA member departments’ ‘case triage’ frameworks (i.e., the combination of policy assessment criteria and a pre-determined ‘escalation ladder’ for cases that require higher levels of managerial approvals). Refer to annexes B to M that provide additional details on each departments’ triage process. Finally, NSIRA reviewed the use and policies around departmental mitigation measures.

FINDINGS

Reporting and Framework Updates

As per the Act, all twelve departments fulfilled their obligations to report to their respective ministers and NSIRA on progress made in operationalizing frameworks and identifying cases escalated to the deputy head level.

Of the nine departments who had reported to NSIRA last year that they had finalized frameworks, all continued to refine assessment protocols over the 2020 review period. Based on submissions to NSIRA, TC has developed a corporate policy to highlight the department’s ACA-related requirements. However, CBSA and PS had yet to finalize their ACA policy. As a result, employees may not have adequate and up to date guidance on how to make determinations related to the ACA.

NSIRA Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.

Referrals to Deputy Head

The Directions specify that when departmental officials are unable to determine whether the risk of mistreatment arising from a disclosure of or request for information can be mitigated, the matter must be referred to the Deputy Head. The Directions also require the Deputy Head, or in exceptional circumstances a senior official designated by the Deputy Head, to determine the matter where the use of information that is likely to have been obtained through mistreatment of an individual by a foreign entity would in any way deprive an individual of their rights or freedoms and the use of this information is necessary to prevent loss of life or significant injury. In 2020, no cases were escalated to the deputy head level. NSIRA sought clarification on the absence of cases referred; the most common reason provided by departments for this outcome was that cases were either mitigated before deputy head involvement and/or this was a result of an overall reduction in the number of foreign information exchanges generally due to the ongoing pandemic.

NSIRA Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.

Case Triage

Typically, when departments are making ACA applicability decisions, they employ varying “case triage” processes, that is, the combination of policy assessment criteria and a pre-determined ‘escalation ladder’ for cases that require higher levels of managerial assessment. NSIRA closely evaluated all twelve ‘case triage’ frameworks of the departments subject to the ACA (Refer to Annex B-M). In carrying out this work, NSIRA noted some issues in the implementation of triage systems; for example, there were instances of not having one designed and of information being outdated.

NSIRA observed that there were two main types of initial case triage processes: case-by-case, where the framework places the onus on the working level official to first make determinations based on policy assessment tools, relevant training, and individual experience; and country assessment rating, which emphasizes the initial use of a country-based risk level that may trigger case escalation. A country assessment rating is a representation of the assessed risk of mistreatment associated to a country, based on a number of criteria and often derived from a range of sources.

Initial Case Triage Category 1: Case-by-Case

All departments use working level officials to determine whether there is a risk of mistreatment. When a working level officials’ assessment is inconclusive as to whether a substantial risk of mistreatment exists, they will defer the decision to a higher management authority. NSIRA has developed Figure 1 to illustrate this type of triage process where the working level official consults assessment tools at his or her disposal to determine whether a substantial risk of mistreatment exists.

Figure 1: Case by Case Triage Diagram

Initial Case Triage Category 2: Informed by Country Assessment Rating

CSIS, CSE, FINTRAC, and RCMP require working level officials to use country assessment ratings that may trigger case escalation. For example, NSIRA has developed Figure 2 to illustrate this type of triage process where country assessment ratings may trigger case escalation.

Case Escalation

In addition to the two categories of case triage frameworks identified above, all departments except for FINTRAC, PS, CSE and TC make use of internal consultation groups/senior decision making committees when cases are identified as requiring consultation/escalation (e.g. working groups and senior management committee secretariats). The following table illustrates the various consultation groups across departments that would make determinations related to the ACA.

The general purpose of consultation groups is to serve as a single point of contact for employees who require assistance in assessing foreign information sharing activities or interpreting policy and procedure. Senior decision making committees are responsible for making determinations on the information exchange. They are the final decision making authority prior to escalation to the deputy head. NSIRA observed that leveraging the overall expertise of these groups may assist officials in consistently applying assessment criteria, as well as provide greater oversight for information exchanges with foreign entities.

Consistency in Implementation Across Departments

Beginning with the 2017 Ministerial Directions on Avoiding Complicity in Mistreatment by Foreign Entities, it was required that departments maintain policies and procedures to assess the risks of information sharing relationships with foreign entities. While not specified in the Act or Directions, departments continue to implement country and entity assessments, a practice NSIRA has supported. NSIRA has previously raised concerns regarding the absence of unified and standardized approach to departments’ country assessments. The PCO-led community response to last year’s recommendation on this element stated in part that:

The information sharing activities of these organizations all serve either an intelligence, law enforcement, or administrative purpose with each carrying different risk profiles, privacy concerns, and legal authorities. Individual departments and agencies are responsible for establishing specific thresholds or triggers in their information sharing frameworks that are appropriate for their operational contexts. It is the view of the Government of Canada that applying the same threshold across all organizations for triggering, evaluating, and elevating cases is not necessarily practical nor essential to ensuring that each department or agency is operating in compliance with the Act.

In order to engage in the questions to which the divergence of thresholds gives rise, NSIRA asked departments to rank bi-lateral information exchanges with foreign partners in terms of volume, excluding exchanges with [***example of foreign entity information sharing***]. Nine of the twelve departments identified ███████ as a foreign exchange entity, a country which is widely recognized as having human rights concerns.

NSIRA then selected only those departments that initially utilize country assessment ratings as a triage method (i.e. FINTRAC, RCMP, CSIS and CSE). [***description of how departments determined foreign entity example***]. Nonetheless, in carrying out this analysis, NSIRA observed that all four departments relied on a combination of open source human rights reports and consultations with other departments. Additionally, RCMP, CSIS and CSE utilize classified intelligence sources.

However, although these departments utilize a similar approach when assessing a country, the assigned rating for ████ was not consistent. CSIS assigned █████████████; FINTRAC and RCMP assigned a [***description of department’s specific ratings***] ; and finally, CSE assigned a ██████ rating.

NISRA examined to what degree country ratings affected the level of approval required for an information exchange. Because CSE has assigned a rating of █████ when they receive a request from ████, a CSE official could require [***description of the factors used to determine the appropriate level process***] CSE acknowledged that its “human rights assessments do not necessarily correlate with the risk level assigned to an instance of sharing,” and nor do they “necessarily correlate to levels of approval or to restrictions to sharing.” [***description of the factors used to determine the appropriate level process***]

In contrast, according to their framework and methodology, an exchange with any one of the █████ authorities listed in the RCMP’s country and entity assessment list could result in an [***description of department’s specific ratings***] because █████ is associated with a country assessment rating. When an entity is yellow, the employee must consider whether or not there is a risk of mistreatment by looking at a list of criteria. If one or more of these criteria exist, the employee must send the case to a senior management committee. NSIRA observes that where the RCMP has a red country rating, the working level official must escalate to the senior management committee. Therefore, unlike CSE and CSIS, country ratings within the RCMP have direct impacts on approval levels.

NSIRA’s ACA report from last year recommended that departments should identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach when interacting with Foreign Entities of concern. While PCO disagreed with this recommendation, NSIRA believes that there remain concerns regarding divergences in country and risk assessments.

NSIRA Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be scalated, significant divergences in the evaluation of risk and the required level of approval emerge.

Following this review, NSIRA intends to further scrutinize the processes employed regarding ACA triage and decision making by reviewing GAC and RCMP.

A case study as provided for in Box 1 exemplifies the divergent nature on the evaluation of risk where two departments’ considered responding to an identical request made by a foreign entity.

Box 1: A divergent decision-making process

[***description of the case study***] The foreign entity provided this information to GAC and CSIS and requested confirmation [***description of the information sharing request***]

In considering whether to respond to this request, GAC determined that the human rights record of the country in question generally and of the foreign entity specifically making the request were of significant concern. GAC’s senior decision making committee, working under the presumption that the individual’s detention was ongoing, considered whether the disclosure of this information “would not substantially increase the detainee’s risk of mistreatment.” The senior decision making committee determined that confirmation of the individual’s previous employment status with GAC was permissible, subject to the determination of CSIS’s assessment.

Ultimately, the decision by CSIS was made by a DG-level executive and, as the foreign entity was listed by CSIS as a restricted partner, information was not shared.

The assessment by GAC’s senior decision-making committee is of concern. The Act and the Directions impose that departments consider whether disclosing or requesting information “would result in a substantial risk of mistreatment.” [***legal advice to department***]

NSIRA agrees with this interpretation of the law, but not with its implementation by GAC in this case. GAC’s position was that responding to the request “would not aggravate” the risk of mistreatment. However, NSIRA is of a different view. Regardless of the information sought, the human rights record of the foreign entity and of the foreign country was of significant concern, and GAC was operating under the presumption that the individual may have already been subjected to mistreatment. While GAC’s sharing could not have accounted for any mistreatment that could have occurred earlier, responding to the request given the facts of this case would have nonetheless resulted in a substantial risk of mistreatment. Therefore, this case should have been refered to the Deputy Minister of Foreign Affairs for consideration.

NSIRA also observes that this case was triaged at different levels within GAC and CSIS. In GAC’s triage process, the decision was made at the higher senior decision-making committee that disclosure was permissible. Comparatively, CSIS’s decision-making process was completed prior to reaching their senior-level committee and yielded the opposite result. The different levels of decision-making and different outcomes underscore a problematic inconsistency in how each organization considers the same information to be disclosed to the same foreign entity. Furthermore, while a department responsible for the information may consult with other departments as to whether disclosure of information is permissible, it cannot abdicate this responsibility and decision-making to another department.

NSIRA Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.

Mitigation Measures

Use of Mitigation Measures

To decrease the risk of mistreatment, departments will employ mitigation measures such as caveats, assurances, sanitization, and redactions. The most common mitigation measures are caveats and assurances. Caveats are specific stipulations appended to information to limit or prohibit certain uses of information unless otherwise authorized by the issuing department. For example, any departments use a ‘third party’ caveat that restricts further dissemination of the information to other departments (domestic and foreign), unless the originating department is consulted on the request to share.

Assurances are not specific to a single information exchange; rather, these are agreements with foreign entities (whether formal or informal), which aim to help ensure that a particular foreign entity understands Canada’s position on human rights and that the entity, in turn, agrees to comply with this expected behaviour. For example, when formulating a risk mitigation strategy for an information exchange, departments will consider written or verbal assurances, who provided the assurance (i.e. working level official or agency head), and whether the assurance is considered credible and reliable.

Furthermore, CSIS, CSE, and GAC have highlighted a number of differences in the types of assurances sought, including a number of informal and formal methods. For example, verbal assurances, scheduled formal assurances, and ad-hoc written assurances can be sought by various levels.

In a related issue, NSIRA observed that there are [***description and an example of a Department’s ability to track compliance***] CSIS, GAC, and CSE indicated that there is ████████████████████████████████████████████████████████████ is not specific to the ACA but is nonetheless key ████████████ when exchanging information with the Government of Canada.

Given that no cases were escalated to the level of deputy head, departments’ lower-level use of mitigation strategies would have taken on considerable prominence in decision making. In a subsequent review, NSIRA intends to further investigate policies of mitigation measures pertaining to their use and tracking.

CONCLUSION

This review assessed departments’ implementation of the directives received under the ACA and their operationalization of frameworks to address ACA requirements.

NSIRA’s first review of departments’ implementation of the Act and Directions was limited to a four month period (September-December 2019). As such, this review constitutes the first examination of the ACA over the course of one full year. NSIRA believes that it is now in a position to conduct in-depth case study assessments of individual departments’ adherence to the ACA and Directions, irrespective of whether or not a department reported any cases to its deputy head. Additionally, future reviews will follow up on the ongoing implementation of NSIRA’s past recommendations.

Annex A: Findings

NSIRA Finding #1: NSIRA found that CBSA and PS did not finalize their policy frameworks in support of Directions received under the ACA over the review period.

NSIRA Finding #2: NSIRA found that from January 1, 2020 to December 31, 2020, no cases under the ACA were escalated to deputy heads in any department.

NSIRA Finding #3: NSIRA found that even when departments employ similar methodologies and sources of information to inform their determination of whether or not a case involving the same country of concern should be escalated, significant divergences in the evaluation of risk and the required level of approval emerge.

NSIRA Finding #4: NSIRA found a procedural gap of concern in a case study involving the disclosure of information, even though information was ultimately not shared. The risk of mistreatment was substantial and the decision should have been referred to the Deputy Minister of Foreign Affairs as the accountable deputy minister for this request.

Annex B: Canada Border Services Agency

Annex B: Canada Border Services Agency Framework

Framework updates: In 2018, Canada Border Services Agency (CBSA) issued a high-level policy document in response to the 2017 MD. Since then, CBSA has drafted updated policies and procedures that have not yet been finalized.

Working Groups: CBSA Avoiding Complicity in Mistreatment Working Group (ACMWG)

Senior Management Committee: Senior Management Risk Assessment Committee (SMRAC). This committee convenes on an as needed basis, to assess cases that have a potential for mistreatment.

[***description of CBSA’s decision making methodology***]

Country Assessment: In-house risk scoring template under development

Mitigation Measures: The CBSA is currently working to strengthen its formal framework/process for deciding whether substantial risk of mistreatment associated with a given request can be mitigated.

Annex C: Canada Revenue Agency

Annex C: Canada Revenue Agency Framework

Framework Updates: The Canada Revenue Agency (CRA) indicated that it did not make any changes to its framework since last year’s response. The department continues to refine its processes and has developed the Canada Revenue Agency Exchange of Information Procedures in the Context of Avoiding Complicity in the Mistreatment by Foreign Entities Act.

[***departmental cabinet confidence***]

Working group: The CRA formed a Risk Assessment Working Group (RAWG) that developed a methodology to assess the human rights records of its information exchange partners, so that senior management can make informed assessments of the risk of mistreatment.

Canada has a large network of international partners with 94 tax treaties and 24 Tax Information Exchange Agreements. Canada is also a party to the Convention on Mutual Administrative Assistance in Tax Matters (MAAC), which includes 144 signatories. These International Legal Agreements allow the CRA to exchange information on request, spontaneously and automatically. Each legal agreement includes secrecy provisions (caveats) that govern appropriate use and disclosure. In addition, members of the Global Forum (Global Forum) on Transparency and Exchange of Information for Tax Purposes are subject to peer reviews on a cyclical basis, including on Confidentiality and Data Safeguard .

Senior Management Committee: During the review period a senior committee was not in place, however there was a formal process to escalate reviews/risk assessment through the Director, Director General and ultimately the Assistant Commissioner of the Compliance Programs Branch (CPB) who is accountable for the administration of the ACA.

Additionally, in July 2021, the CRA established an ACA governance framework that includes the ACA Panel, a senior management consultative committee to support risk assessments, reporting, recommendations, and priorities. The panel currently consists of DGs and Directors within the CPB and the Legislative Policy and Regulatory Affairs Branch. Also in July 2021, the CRA established an executive level committee to consider and develop recommendations on case specific engagements as well as issue identification and guidance. The committee consists of Directors across several directorates of the CRA that manage programs that are directly impacted by/reliant on exchange of information with other jurisdictions.

Triage: The initial assessment is done by a working level employee and requires, at minimum, director approval. The case may escalate to the DG and the AC and so on if there is doubt about risk mitigation.

In cases where risk was identified, there were challenges in conducting full assessments to determine if the risk was substantial, the CRA delayed disclosing the information until the full assessment could be completed. This was largely in part due to COVID-19. As such, files that normally would have been referred were temporarily put on hold and no action was taken during the review period.

The CRA informed NSIRA that funding from the November 2020 Fall Economic Statement was allocated to the creation of a dedicated risk assessment team. It is anticipated that the development and regular updating of country-level assessments and the preparation of individual-level risk assessments will transition to this new dedicated team housed within the CPB, in summer 2021.

The team will also be responsible for:

  • Creating and formalizing the framework for consulting with CRA senior management and other government departments and agencies;
  • Advising CRA officials who engage in exchange of information (EOI);
  • Identifying mitigation and other factors specific to the type of information that CRA exchanges and that would impact risk assessment;
  • Preparing annual and other reporting required under the Act and Directions;
  • Providing awareness and training sessions; and
  • Continuously improving documentation, policies, guidance, and procedures.

Country/Entity Assessments: Since January 2020, the CRA has completed their own set of mistreatment risk assessments for each potential information exchange, including the use of information received from the CRA’s information exchange partners in consultation with other Government of Canada partners. The CRA can only exchange information with another jurisdiction pursuant to a treaty, tax convention or other legal instrument that permits exchange of tax information.

The CRA uses a colour coded system to rate the risk related to a country: green; yellow; red. However, for specific or spontaneous exchanges of information, the CRA completes an analysis based on the specifics of the file to supplement the country specific risk assessment.

Mitigation Measures: Mitigation measures, including caveats (data safeguards and confidentiality provisions) are embedded in all legal instruments that govern and allow for all the CRA’s exchanges of information, while peer reviews of jurisdictions’ legal frameworks and administrative practices provide assurances of exchange partners’ compliance with international standards for exchange of tax information. According to CRA, all information exchanged during the review period were subject to these mitigation measures. Due to COVID19, and for the period under review, the CRA put on hold all exchanges where it was deemed there may be a residual potentially significant risk of mistreatment until a process and mitigation measures were in place, including to redact information. However, the CRA routinely redacted personal information where it would not impact the substance of the exchange for those mitigated risk exchanges that did proceed during this period.

Annex D: Communications Security Establishment

Annex D: Communications Security Establishment Framework

Framework Updates: No changes made to the framework in 2020. It is the same procedure as the last review period.

Working group: Based on the RFI, there are no working groups leveraged to assess the level of risk of mistreatment. The Mistreatment Risk Assessment Process follows a process that has been refined continuously since its inception in 2012. The higher the level of risk (low, medium, high, substantial), the higher approval authority required to exchange or use information.

Senior Management Committee: There is no Senior Management Committee. As explained above, CSE relies on an approval authority scale based on the level of risk (from low to substantial). Senior level officials are involved in the process when there are medium and high-risk cases, which require Director and Director General/Deputy Chief approval, respectively.

Triage: A CSE official performs an initial assessment by consulting the Mistreatment Risk Assessment (MRA), which considers equity concerns, geolocation and identity information, human rights assurances, risk of detention and a profile of the recipients’ human rights practices.

Low (For Low Risk Nations)

If the MRA indicates a low level of risk, the official will need Supervisor [***specific unit***], approval if they wish to proceed with the information exchange or use.

Low (For non-Low Risk Nations)

If the MRA indicates a low level of risk, the official will need Manager [***specific unit***], approval if they wish to proceed with the information exchange or use.

Medium

If the MRA indicates a medium level of risk, the official will need Director, Disclosure and Information Sharing approval if they wish to proceed with the information exchange or use.

High

If the MRA indicates a high level of risk, the official will need Director General, Policy Disclosure and Review or Deputy Chief, PolCom approval if they wish to proceed with the information exchange or use.

Substantial

If the MRA indicates a substantial level of risk, the official may not proceed with the information exchange or use.

Country Assessments: CSE establishes its own country assessments (which CSE refers to as Human Rights Assessments) by using information from OGDs, its own reporting, and open source information. Foreign entity arrangements are reviewed annually. These HRAs are part of CSE’s MRAs.

There are two types of MRAs: Annual and Case-by-case. Annual MRAs include foreign entities with whom CSE regularly exchanges information, [***description of the foreign entities with whom CSE exchanges information***] Caseby-case MRAs are conducted in response to particular requests. Case-by-case MRAs often concern individuals and information sharing activities. There are Abbreviated MRAs, which are a sub case-by-case MRA, and they are conducted for Limited Risk Nations. These nations are considered low risk by CSE.

When making MRAs, CSE does the following:

  • assesses the purpose of the information sharing;
  • verifies there are mistreatment risk management measures in existing information sharing arrangements;
  • reviews CSE’s internal records on the foreign entity under consideration;
  • consults other available Government of Canada assessments and reports related to the foreign entity;
  • assesses the anticipated effectiveness of risk mitigation measures; and
  • evaluates a foreign entity’s compliance with past assurances, based on available information.

CSE consults with GAC, DND, and the Ministers of Foreign Affairs and National Defence for some MRAs, usually case-by-case ones. CSE may also consult GAC for human rights-related advice in certain instances.

Mitigation Measures: CSE considers a number of mitigation factors, such as risk of detention, [***statement regarding information sharing obligations of partners***] caveats, formal assurances, and bilateral relationships. CSE’s principle mitigation measure is Second Party assurances. [***statement regarding information sharing obligations of partners***]

Identifying/Sensitizing: The DG, Policy Disclosure and Review or the DC PolCom review high-risk cases. 303 information-sharing requests were assessed for risk of mistreatment and 10 of them (3%) were referred to the Director, Disclosure & Information Sharing. For the 2020 review period, the Deputy Chief, Policy and Communications was responsible for ACA accountability and quality assurance.

Annex E: Canadian Security Intelligence Service

[***Info-graphic of CSIS’s Risk Assessment process***]

Framework Updates: While there were no changes during the 2020 review period, CSIS modified its procedure on January 2021. Most notably, cases will only be escalated to ISEC if the DG cannot determine if the substantial risk can be mitigated. In addition, CSIS merged the [***statement regarding internal process***] CSIS updated its human rights ‘Assurances’ procedures as a stand-alone policy. This policy requires CSIS Stations to seek assurances from [***statement regarding internal process***] coordination responsibilities for ISEC were moved to the ██████████. Through that, the █████ became ISEC’s Chair.

Triage: CSIS working-level officials do the initial assessment. This assessment requires the official to determine if one or more of the four risk criteria are met. These criteria are:

  • “Based on the available information about the foreign entity, if the information is disclosed or requested, is there a probability that the foreign entity will engage in torture or other forms of cruel, inhuman or degrading treatment or punishment against an individual(s)?”
  • “If the information is disclosed or requested, is there a probability that the foreign entity will disseminate the information in an unauthorized manner to a 3rd party, which may result in torture or other forms of cruel, inhuman or degrading treatment or punishment against an individual(s) by that 3rd party?”
  • “If the information is disclosed or requested, is there a probability that it may result in the extraordinary rendition of an individual(s) by the foreign entity which would lead to the individual(s) being tortured or subject to other forms of cruel, inhuman or degrading treatment or punishment?
  • “If the information is disclosed or requested, is there a probability or an extrajudicial killing of an individual(s) by the foreign entity or other security entities within the country?”

Four scenarios could occur before a case lands at ISEC:

[***description of four possible scenarios and the assessment criteria used to determine risk mitigation and/or ecalation***]

Working Group: While there is a senior management committee, there is no working level group on the operations side.

Senior Management Committee: ISEC is CSIS’s senior-level review committee for foreign information sharing activities. It is composed of CSIS senior managers and representatives from DoJ and GAC. This committee is responsible to determine if a case poses a substantial risk and if it can be mitigated. If ISEC cannot determine if the substantial risk is mitigatable, the case is referred to the Director. Of note, GAC and DoJ are no longer voting members on ISEC but will continue to provide feedback and advice.

Country Assessments: CSIS conducts its own country assessments. Each information exchange arrangement with a foreign entity has its own Arrangement Profile (AP). APs include a summary of the human rights summary.

Mitigation Measures: CSIS relies on a few mitigation measures. First, CSIS widely uses ‘Form of Words’, which include caveats. Second, CSIS uses assurances and relies on standardized templates provided to foreign entities. CSIS may also tailor assurances to address specific concerns, such as extra-judicial killings.

Identifying/Sensitizing Information: ██████ is responsible for CSIS’s information sharing framework. [***name of a specific unit***] is responsible for official policy management. Concerned program areas are responsible for applying related polices and procedures for ACA-related activities.

Annex F: DFO

Annex F: DFO Framework

Framework Updates: Fisheries and Oceans Canada (DFO) did not make any changes to last year’s approach.

Triage: The initial assessment is made by the person receiving the request for information sharing or who first comes into possession of information derived from a foreign source. Risk is determined on a case-by-case basis.

The sector-level analyst/officer does the initial assessment and relies on OGD assessments to determine the level of risk. They determine the level of risk in relation to the specific case and whether they assess that there is a substantial risk or not will impact the level of approval. If the analyst/officer does not think there is risk, the case may proceed. This, according to the decision screen and information received, does not require any manager or senior level approval.

If the analyst/officer believes or is unsure that there is a substantial risk, the senior-level Internal Review Committee (IRC) must seek DM approval.

Working Group: Internal Review Committee

Senior Management Committee: DFO employs the use of a decision screen and the IRC as demonstrated above. It is unclear whether DFO has developed guidance to help officials and management accurately and consistently determine the risk of mistreatment.

Country Assessments: DFO relies on country assessments conducted by GAC (as well as DFO legal services, RCMP and CSIS as needed) to make mistreatment risk determinations.

Mitigation measures: DFO indicated that it employs the use of caveats and assurances as necessary but has not yet had to seek such assurances. As such, there is no tracking mechanism in place. The Department is able to retroactively determine when, how, and why a decision was made through its record keeping system. A process is in place to record the details of each case, its evaluation process, and any resulting actions and decisions.

Annex G: Department of National Defence/Canadian Armed Forces

Annex G: Department of National Defence/Canadian Armed Forces Framework

Framework Updates: The Department of National Defence (DND) indicated that there were no changes to its framework since last year’s response.

Triage: The process of assessing risk is largely the same across all three forms of information sharing transactions. The process involves examining country human rights conditions, and researching specific partner entities, including any reports of mistreatment. Adverse information on a foreign partner is reviewed by the Defence Information Sharing Working Group (DISWG) and recommendations are made to the implicated L1s on how to manage information sharing activities (request, disclosure, or use). There are no differences in the types of mitigation measures employed across the three forms of information sharing. The primary governance document Release and Disclosure Officers (RDOs) and Release and Disclosure Authorities (RDAs) must adhere to is the CDI Interim Functional Directive: Information Sharing with Certain Foreign States and their Entities.

Working Group: The Defence Information Sharing Working Group (DISWG) is a working-level committee led by the Release and Disclosure Coordination Office (RDCO) within CFINTCOM that serves as an advisory body to operation Commanders regarding issues covered under the ACA. This Working Group exists as a platform for open dialogue related to information sharing arrangements and transactions. This group convenes monthly, or as required.

Senior Management Committee: The Defence Information Sharing Assessment Committee (DISAC) is chaired by the Chief of Defence Intelligence / Commander CFINTCOM . The DISAC’s primary object is to act as an advisory committee for the Deputy Minister and the Chief of Defence Staff in support of their decision making regarding issues pertaining to the ACA.

Country Assessments: Currently, RDCO has established a list of low-risk countries that can be referred to by other L1s. Inclusion in this list indicates CDI’s confidence that sharing information with government entities of that foreign state can take place without a substantial risk of mistreatment. Moreover, RDCO has developed a draft methodology for Country Human Rights Profiles to classify countries as low, medium, or high risk but has only begun producing country human rights profiles on a few medium and high-risk countries and the methodology has not yet formally approved. These profiles will be used by other L1s in the development of specific Partner Entity Assessments and to inform the overall risk assessment of sharing information with foreign entities.

Information Management: There is no common shared system or repository for all RDOs. Information decisions are recorded by RDOs at the unit level. In some cases, all transactions are recorded using a spreadsheet and should include all details relating to the collection, retention, dissemination or destruction of the information, but the precise format will vary. CFINTCOM is working to standardize RDO logs across DND/CAF. From an information management perspective, there have been no changes since last year’s report. Records of discussion of all DISWG meetings are kept centrally within RDCO/CFINTCOM and it is possible to retroactively determine how and why a decision or recommendation was made.

Mitigation Measures: DND uses mitigation measures to reduce the risk of mistreatment. For example, DND uses measures such as the sanitization of information, the inclusion of caveats, and/or the seeking of assurances, including on low-risk cases in order to err on the side of caution.

Annex H: FINTRAC

Annex H: FINTRAC Framework

Framework Updates: The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) did not make any changes to their framework for the 2020 review year.

Triage: Who does the initial assessment will depend on the risk level classification of the country. If it’s green, the intelligence analyst (IA) does the risk assessment. If it’s yellow, the IA’s team leader does the risk assessment. If it’s red, Senior Level does the risk assessment. Regardless of the determined risk level, Senior Level must ultimately approve or decline the information exchange/use.

Partnerships and Working Groups: FINTRAC makes use of external organizations, such as the Egmont group, to ensure that member organizations are adhering to global standards against mistreatment. If one of these groups is found to have breached their duty of care, and is expelled from the group, then FINTRAC will cease to exchange information until the matter has been rectified. FINTRAC enters Memoranda of Understandings (MOUs) with nations who wish to exchange information with them. To do so, each nation is assessed using a variety of criteria to determine their risk rating and whether an MOU should be established.

FINTRAC also regularly participates in ISCG meetings alongside other departments.

Senior Management Committee: FINTRAC does not have a senior management committee to determine risk like other departments. Instead, they rely on senior management and the Director to make final decisions on cases.

Country Assessments: FINTRAC established its own country assessments. Establishing each country assessment involves gathering pertinent information on the human rights situation in the country and using indicators to assess the risk level of mistreatment of each country. During the development of the country assessment process, FINTRAC consulted with other agencies/government departments captured under the ACA.

The Manager of International Relationships is responsible for monitoring and assessing the human rights profile of countries with which FINTRAC shares an MOU.

Mitigation Measures: Caveats and assurances are established at the signing of an MOU and repeated whenever sharing information with any foreign entity. The sharing of information is not allowed without a signed MOU.

Annex I: Global Affairs Canada

Annex I: Global Affairs Canada Framework

Framework Updates: Global Affairs Canada (GAC) indicated that no changes to their framework was made during the current review period.

Triage: There is not one unified set of processes at GAC for determining whether information being used by the department is likely to have been obtained through the mistreatment of an individual by a foreign entity. If an official determines that information that he or she has received is likely to have been obtained through the mistreatment of an individual by a foreign entity and that official still wants to use the information, they are instructed in their training to consult with their Program management at HQ. Should that manager be unable to make a determination on their own as to whether the use would comply with the Act, they will consult the relevant departmental policy group and the department’s Legal Services Unit.

Working Groups: The Ministerial Direction Compliance Committee Secretariat

Senior Management Committees: The Ministerial Direction Compliance Committee (MDCC) meetings focuses on the following:

  • Has the information, the use of which is being sought, likely been derived from mistreatment?
  • What are the proposed measures to mitigate the risks? What is the likelihood of their success?
  • Consider the justifications for and proportionality of any potential involvement with the foreign state or entity that may result in mistreatment.

The MDCC Secretariat will create a record of decision and circulate it for comment by MDCC members. Once finalized, it will be kept by the Secretariat for future reporting. The MDCC Secretariat follows up with the requesting official for updates on the outcome of the situation and requests a final update from the requesting official once the situation is resolved. Currently the MDCC Secretariat consists of one person.

Country Assessments: Global Affairs Canada’s human rights reports provide an evidence-based overview of the human rights situation in a particular country, including significant human rights-related events, trends and developments and include a section focused on mistreatment. There are no scores for countries however, and it is up to the officials to assess the risk based on the information in the reports.

Mitigation Measures: The Legal Services Unit and/or Intelligence Policy and Programs division will provide guidance on the limitations and the prohibitions of the use of information obtained through mistreatment. They are also able to propose potential mitigation measures, such as sanitization of the information, if there is a risk of further mistreatment; of depriving someone of their rights or freedoms; or if the information could be used as evidence in any judicial, administrative or other proceeding.

Annex J: IRCC

Annex J: IRCC Framework

Framework Updates: Immigration, Refugees and Citizenship Canada (IRCC) indicated that there were no changes to its procedures regarding the disclosure of information to foreign entities.

Triage: The initial assessment is done by the employee/officer receiving a request to disclose information. Officers are provided with a country assessment tool that provides a country-level risk assessment. If the country is listed as low-risk and the employee does not believe there are any risks of mistreatment, they may proceed with the exchange and record the details of that exchange (i.e., what information was exchanged; to which country, etc) into the Global Case Management System (GCMS). If the country is high-risk, or the officer believes that there is any risk of mistreatment and they wish to pursue with the case, then the officer is required to refer the case to IRM and Admissibility to assess the risk of the exchange.

Senior Management Committee: IRCC has the Avoiding Complicity Assessment Committee. The Committee is comprised of executives representing relevant policy, operations, legal and privacy branches within the Department. The purpose of the Committee is to reassess whether the circumstances of the case meet the “substantial risk” threshold, and to determine whether mitigations could be sufficiently imposed to allow for the disclosure. If the Committee is unable to unanimously determine if the risk can be mitigated, and there remains a need to disclose the information to the requesting foreign entity, then the case will be referred to the Deputy Minister for final decision.

Country Assessments: IRCC officers are instructed to refer to an initial country assessment tool when they are contemplating any disclosure or request for information from a foreign entity. This tool provides a general assessment of the country’s risk. If the country is identified as a high-risk country, then the officer is required to make a Consultation Request before disclosing, requesting or using information. If the country is identified as medium-risk, then it is recommended that the officer make a Consultation Request.

Mitigation Measures: Possible mitigation measures for a case where a substantial risk of mistreatment has been determined, if available, would be established in the Consultation Request assessment and, if necessary, in the Avoiding Complicity Assessment Committee’s recommendation. In either case, the mitigations will be manually recorded in the case file where they can be later recalled and noted in the Annual Report.

Annex K: Public Safety

Annex K: Public Safety Framework
Annex K: Public Safety Framework Image 2

Please note that the above flow charts are draft and have not yet been approved.

Framework Updates: Public Safety (PS) does not yet have a framework for deciding whether an exchange of information with a foreign entity would result in a substantial risk of mistreatment of an individual. PS noted, however, that it has drafted a departmental policy to support the department’s implementation of the Directions but it has not yet been approved by senior management.

Triage: PS officials at the operational level are responsible for identifying whether the disclosure of or request for information would result in a substantial risk of mistreatment of an individual. Prior to the disclosure of or request for information to/from a foreign entity, PS officials, as per the draft policy, are expected to:

  • review risk assessments and information sharing arrangements/agreements to determine risks;
  • identify mitigation measures as needed; and
  • seek DG approval for the disclosure or request; and the DG would determine whether the risk can or cannot be mitigated and whether the case should be referred to the DM for determination and decision.
  • PS officials at the operational level are responsible for identifying whether information for potential use was likely obtained through the mistreatment of an individual. As per the draft policy, prior to the use of information, PS officials are expected to:
  • conduct an assessment to determine if the information was likely obtained through the mistreatment of an individual, if not previously completed by PS officials or another government department, and mark it accordingly, based on DG-level determination;
  • assess and characterize the accuracy and reliability of the information; and,
  • advise their DG of the circumstance; and the DG would determine whether the information would be used as per section 3 of the Directions and refer the decision to the DM to determine if the use of information in any way that deprives someone their rights or freedoms is necessary to prevent the loss of life or significant personal injury.

For PS program areas where responsibilities for program delivery are shared among multiple Government of Canada departments, PS officials may use accuracy and reliability assessments conducted by another Government of Canada department for the express purpose of the specific information exchange. In these cases, and where PS does not have sufficient information (such as the source of the information) to conduct an assessment, it will require Government of Canada departments to attest to having conducted the assessment. This same principle applies risk assessments and assessments as to whether information was likely obtained through the mistreatment of an individual.

Working Group: The ISCG is the primary interdepartmental forum for supporting interdepartmental collaboration and information-sharing between members as they implement the Act and Directions and is regularly attended by all members.

PS participates in the ISCG in three ways as the:

  1. chair, coordinator and PS policy lead;
  2. area responsible for implementing the ACA;
  3. legal counsel representative.

PS has also made progress with ISCG guidance. However, due to COVID-19, the ISCG was limited in its capacity to convene meetings.

Senior Management Committee: PS does not have a formal senior management committee to review high-risk cases. The Investigative Authorities and Accountability Policy (IAAP) unit supports program areas in the referral process to the Senior Assistant Deputy Minister (SADM) of the National and Cyber Security Branch for further examination. Acting as a senior Public Safety official, the SADM is responsible for referring cases to the Deputy Minister if they are unable to determine whether the risk of mistreatment can be mitigated.

Country Assessments: PS currently does not have any country assessments completed and plans to use other department’s assessments, but as outlined in its draft policy, PS expects to conduct country and entity assessments as part of its annual risk assessment process. The risk assessment process will ensure that an agreement with the foreign entity is in place prior to information sharing exchanges; review risk and country assessments developed by portfolio agencies (e.g. CSIS) and other departments (e.g. GAC), and consider human rights reporting from non-government entities.

The IAAP will coordinate, on an annual basis, risk assessments. To do so, IAAP may, for example, review human rights reports developed by Global Affairs Canada (GAC), country assessments prepared by portfolio agencies (e.g. CSIS), human rights reporting from non-government entities and country/entity specific material.

Mitigation Measures: PS currently has developed a draft policy to address mitigation measures and caveats. The draft policy will provide guidance to officials on how to assess risk and apply mitigation measure, while also defining approval levels and country assessment responsibilities.

Once a risk of mistreatment has been identified, the PS official is required to undertake a risk mitigation assessment prior to requesting the information. Approved risk mitigation mechanisms include:

  • the caveating of information,
  • obtaining assurance and/or
  • disclosing a limited amount of the information.

The policy also outlines requirements regarding the use of congruent mitigation mechanisms to collectively reduce the risk.

Annex L: Royal Canadian Mounted Police

Annex L: Royal Canadian Mounted Police Framework

Framework Updates: There were no changes to the Royal Canadian Mounted Police’s (RCMP) framework in 2020. RCMP has undertaken a number of internal reviews of its information sharing framework and continues to refine and optimize its processes.

RCMP also noted that it was in its final stages of rolling out an online training course specifically tailored to the ACA.

Triage: The Foreign Information Risk Advisory Committee (FIRAC) process may be initiated if and when an information exchange involves a country identified as high or medium risk. A low-risk case would only be sent if an official believes there is the potential for mistreatment.

All RCMP personnel are required to consider the risk of mistreatment before requesting, disclosing or using information and to engage the FIRAC process if there is a substantial risk identified to a specific individual(s) with a country of exchange.

An employee is almost always the one to perform the initial risk assessment. When an entity is green, the employee may exchange or use information without consulting FIRAC, unless they express doubts. When an entity is yellow, the employee must consider whether or not there is a substantial risk of mistreatment by looking at a list of criteria (similar to CSIS). If one or more of these criteria is present, the employee must send the case to FIRAC. If the entity is red, the employee must send the case to FIRAC for the initial assessment, unless no personal information is exchanged.

Working Group: Law Enforcement Assessment Group (LEAG). Full-length LEAG assessments include classified information from other Federal departments and agencies. The FIRAC Portal was developed to allow RCMP employees to access the assessments, and to further support compliance with the directions.

Senior Management Committee: FIRAC was established to facilitate the systematic and consistent review of RCMP files to ensure information exchanges do not involve or result in the mistreatment of any person.

FIRAC holds the responsibility to determine if a substantial risk exists and in cases where a substantial risk of mistreatment exists, make a recommendation on whether the proposed mitigating measures are adequate to mitigate the risk.

FIRAC’s recommendations are made by the Chair, upon the advice of the Committee, to the appropriate Assistant Commissioner / Executive Director responsible for the operational area seeking to disclose, request or use the information.

FIRAC determines if the risk is mitigatable or not. If it is, the case goes to the Assistant Commissioner. If it is not, FIRAC declines the exchange or use of information.

Country Assessments: An in-house country assessment model has been completed.

Countries are listed in alphabetical order, along with any specific foreign entities (i.e. police forces, military units, etc.) that have been assessed. For each entity, the risk level (Red-High, Yellow-Medium, Green-Low) is provided, as are the specific crime types and conditions.

Mitigation Measures: The RCMP leverages existing MOU’s with specific partners to partially mitigate underlying risk, in particular where mutually agreed standards around human rights exist as well as having a good track record for respecting caveats. Similarly, officials work with Liaison Officers to identify any relevant assurances or strategies, factors or conditions that could mitigate the risk of mistreatment posed by the information exchange, request for information or use of information.

All mitigation measures used are tracked through the FIRAC by filling in a FIRAC Request Form. Noting which mitigations/caveats are used is a mandatory part of the process.

Annex M: Transport Canada

Does not have a departmental framework for assessing ACA considerations, outside of the Passenger Protect Program (PPP).

Changes: Transport Canada (TC) developed a corporate policy in September 2020 to highlight the department’s ACA-related requirements, roles and responsibilities and remains a participant in PS framework.

Triage: Relies on PS’ framework for the Passenger Protect Program.

Should they have any concerns about a request for information from a foreign partner they will consult with other agencies, such as CSIS or GAC.

Working Group: TC is a voting member of the PPP Advisory Group but does not have any responsibility for drafting case briefs. At each meeting of the PPP Advisory Group, TC has ensured that all other voting members have acknowledged TC’s SATA-legislated responsibility for sharing the List with domestic and foreign air carriers, and its associated responsibilities under the ACA.

Senior Management Committee: TC does not have any senior management committee in place to further review cases with a potential for mistreatment.

Country Assessments: Rely on other government departments.TC relies on assessments by other departments such as PS and GAC.

Mitigation measures: The framework was established by Public Safety (lead on PPP), with consultations with the PPP partners (RCMP, CSIS, CBSA). TC has worked with PS to integrate mitigation measures into the operating procedures and protocols of PPP partners.

Share this page
Date Modified:

Review of the CSE ministerial authorizations and ministerial orders under the CSE Act

Backgrounder

Following the coming in to force of the Communications Security Establishment Act (CSE Act), CSE received a new set of Ministerial Authorizations (MA) – written documents by which the Minister of National Defence authorizes CSE to engage in activity that risks contravening an “Act of Parliament or interfering with a reasonable expectation of privacy of a Canadian or person in Canada.” The CSE Act also created a legislative authority for the Minister of National Defence to “designate electronic information or information infrastructures or classes of electronic information or information infrastructures as being of importance to the Government of Canada” through a Ministerial Order (MO).

NSIRA’s Foundational Review of CSE’s Ministerial Authorizations (MAs) and Ministerial Orders (MOs) represents a different approach to reviewing MAs than that of the Office of the Communications Security Establishment Commissioner (OCSEC), CSE’s former independent external review body. While OCSEC previously reported on the number of private communications, we leave this matter to CSE’s classified annual report to the Minister. Further, it is not necessary to review whether Ministerial Authorizations are based on reasonable conclusions, which is now the responsibility of the Intelligence Commissioner. NSIRA chose to approach the Ministerial Authorizations as an opportunity to learn about CSE’s operational activities, and the Ministerial Orders were reviewed as supplementary to the Ministerial Authorizations.

This foundational review highlighted the need to focus on Active and Defensive Cyber Operations immediately following the completion of this review, given that the Intelligence Commissioner does not approve these activities and that they represent a new aspect of CSE’s mandate.

Table of Contents

Date of Publishing:

Share this page
Date Modified:

Review of CSIS threat reduction activities: A Focus on Information Disclosure to External Parties

Review Backgrounder

This is the second annual review of the Canadian Security Intelligence Service’s (CSIS) threat reduction measures (TRMs) completed by the National Security Intelligence Review Agency (NSIRA). This review sought to expand upon findings from last year’s review by examining a larger number of TRMs wherein CSIS disclosed information to external parties with their own levers of control, to reduce identified threats.

The review studied the characteristics of these particular TRMs but focused its examination upon the extent to which CSIS appropriately identified, documented and considered any plausible adverse impacts that these measures could have on affected individuals.

Date of Publishing:

1. Executive Summary

██ This is the second annual review of the Canadian Security Intelligence Service’s (CSIS) threat reduction measures (TRMs) completed by the National Security Intelligence Review Agency (NSIRA). This review sought to expand upon findings from last year’s review by examining a larger number of TRMs wherein CSIS disclosed information to external parties with their own levers of control, to reduce identified threats.

██ The review studied the characteristics of these particular TRMs but focused its examination upon the extent to which CSIS appropriately identified, documented and considered any plausible adverse impacts that these measures could have on affected individuals.

██ With respect to the TRMs studied, NSIRA observed that ███████████ of external parties were involved in these TRMs, ██████ which had varied levers of control with which they could take action against identified threats or the subjects of these measures. NSIRA also observed that CSIS disclosed different kinds of information to external parties for these TRMs. NSIRA noted that CSIS’s documentation of TRMs was uneven. CSIS did not always document ████████████████████ sometimes excluded an account of the actions taken by external parties as part of these measures. NSIRA also noted that CSIS documentation of the information it disclosed to external parties, as part of these TRMs, was inconsistent, and at times, lacked clarity and specificity.

██ An understanding of both external parties’ levers of control and the scope and breadth of information disclosed to external parties for TRMs is important and feeds into the overall risk assessment of each proposed measure. Without more robust documentation, CSIS is neither capable of assessing the efficacy of its measures nor appreciating the full impact of its actions on the subjects of its measures.

██ In 2020, NSIRA asserted that, when determining whether a warrant is required, CSIS should consider impacts on individuals resulting from the entirety of threat reduction measures: both from CSIS’s disclosure of information and from actions taken by recipient external parties, to reduce the threat. The adverse impacts on individuals observed in the TRMs examined for this year’s review underscore NSIRA’s position.

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████.

██ The current assessment framework ████████████ to determine whether a warrant is required is overly narrow and does not sufficiently consider the full impacts of CSIS threat reduction measures. NSIRA recommends that CSIS consider plausible adverse impacts resulting not only from CSIS disclosures of information but also from the actions of external parties as part of TRMs, when determining whether a warrant is required.

██ NSIRA was able to use its direct access to CSIS information repositories to confirm information that it needed to verify and to pursue necessary additional inquiries. For that reason, NSIRA has a high level of confidence in the information on which it relied to complete this review. NSIRA would also like to recognize that CSIS was timely in responding to NSIRA’s requests for information throughout the course of this review.

2. Authorities

██ This review was conducted under the authority of subsection 8(2) of the National Security and Intelligence Review Agency Act (NSIRA Act).

3. Introduction

Background

██ This review is the second annual review of CSIS threat reduction measures (TRMs) completed by the National Security Intelligence Review Agency (NSIRA).

██ In its first review of TRMs (NSIRA’s 2020 review), NSIRA examined ███ TRMs in which CSIS disclosed information to an external party. In all cases examined, CSIS disclosed the information to an external party in order for the external party to take action in some way using its own levers of control to address the identified threat.3 This year’s review examined a larger subset of TRMs that involved CSIS disclosing information to an external party for the purpose of obtaining a desired threat reduction outcome. NSIRA focused primarily on examining how CSIS identifies and considers the plausible adverse impacts of these measures on affected individuals.

Scope

██ The review period covers June 18, 2015 to December 31, 2020, and includes ██ proposed TRMs that involved CSIS disclosing information to an external party for the purpose of using that external party as a conduit for the desired action against the subject of the TRM. Of these ██ proposed TRMs, ██ were approved and ██ were implemented.

Sources and Methodology

██ NSIRA examined information from a variety of sources, including:

Document Review

  • ██ Ministerial directions issued by the Minister of Public Safety and Emergency Preparedness to CSIS.
  • ██ CSIS’s internal governance framework for TRMs, which included policies, procedures, guidance and training material, tracking systems and cooperation agreements.
  • ██ All pertinent threat reduction measure documentation, ██████████████████████████████████████████ email communications, operational messages, and █████████████.
  • ██ Relevant █████████ , including responses to NSIRA’s Requests for Information.

Briefing

  • ██ One briefing from the Department of Justice.

Analysis of Administrative Data

  • ██ Descriptive statistics of the TRM sample.
  • ██ Cross-reference of TRM subjects in the review sample with NSIRA’s investigation files for complaints submitted to SIRC (2015 to July 2019) and NSIRA (July 2019 to 2020) in order to document any complaints investigations underpinned by a CSIS TRM.

TRM mandate

██ In June 2015, Parliament enacted the Anti-terrorism Act, 2015, which authorized CSIS, in the new section 12.1 of the CSIS Act, to take measures to reduce threats to the security of Canada, within or outside Canada. The new measures represented an unprecedented departure from CSIS’s traditional intelligence collection role.

██ In July 2019, the National Security Act, 2017, came into force and introduced amendments to CSIS’s TRM mandate that sought to clarify and further define this power. In particular, the amendments stressed the importance of compliance with the Canadian Charter of Rights and Freedoms (Charter). They included specific provisions affirming the need for all TRMs to comply with the Charter, and stipulating that measures could only limit Charter rights or freedoms if authorized by a judge under a warrant. The amendments also included an expanded list of prohibited conduct under the TRM regime: among other things, CSIS cannot engage in measures that cause death or bodily harm, subject an individual to torture, or detain or violate the sexual integrity of an individual.

██ The CSIS Act does not provide a precise definition of “measures to reduce the threat.” As such, CSIS has developed its own definition to guide its TRM activities. According to CSIS, a TRM is “[a]n operational measure undertaken by the Service, pursuant to section 12.1 of the CSIS Act, whose principal purpose is to reduce a threat to the security of Canada as defined in s. 2 of the CSIS Act.

██ Section 12.1 of the CSIS Act states that CSIS may only undertake a TRM if there are reasonable grounds to believe that the identified conduct is a threat to the security of Canada. TRMs must be reasonable and proportional in the circumstances, having regard to the nature of the threat, the nature of the measures, the reasonable availability of other means to reduce the threat, and the reasonably foreseeable effects on third parties, including on their right to privacy. CSIS must also consult with other federal departments, where appropriate, with respect to whether they may be in a position to reduce the threat. CSIS must also seek a warrant from a judge where a proposed TRM would limit a right or freedom guaranteed by the Charter or would otherwise be contrary to Canadian law.

██ The 2015 Ministerial Direction for Operations and Accountability and the 2019 Ministerial Direction for Accountability issued by the Minister of Public Safety require all TRMs to undergo a four-pillar risk assessment that examines the operational, political, foreign relations, and legal risks of proposed actions on a scale of low, medium or high. In addition, they require that, when assessing the appropriate means of reducing a threat, CSIS consider the range of other possible national security tools available to the broader community, and consult with departments and agencies of the Government of Canada with mandates or authorities closely related to the proposed TRM.

Governance

██ CSIS’s TRM unit is made up of full-time employees, and is responsible for developing and updating policies and procedures related to TRMs; it also provides support to operational units involved with TRMs.

██ Operational units must consult with the TRM unit at the planning stage, and while drafting ██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██ CSIS’s governing policy outlines the requirements associated with planning, approving, implementing, and reporting TRMs, including their use in exigent circumstances.9 The policy replicates the relevant provisions of the CSIS Act, without adding much direction beyond citing the existing legislative regime. For example, the policy incorporates the Act’s requirement to ensure that TRMs are reasonable and proportional, having regard to the nature of the threat, the nature of the measures, the reasonable availability of other means to reduce the threat, and the reasonably foreseeable effects of the measure on third parties, including their right to privacy. ████████████████████████████████████████████████████████████████████████████████

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

███████████████ NSIRA notes that in conducting its legal assessments, ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████.

██ CSIS has also developed internal guidelines for consultations with other government departments, ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

4. Findings and recommendations

Brief overview – TRMs, by the numbers

During the review period, CSIS proposed TRMs in total.

  • proposed measures involved an external party that had an ability to act using its own levers of control.
  • Of these proposed measures, were approved and implemented.
  • Of the approved measures, none of them, in CSIS’s view, required judicial authorization, or warrants, to proceed.

██ Comprising █████████ proposed measures, information disclosure to external parties was a common strategy that CSIS proposed as part of TRMs, to reduce perceived threats to the security of Canada.

CSIS’s information disclosures as part of TRMs

██ NSIRA examined documentation supporting the ██ proposed TRMs, including the ██ implemented TRMs where CSIS disclosed information to an external party to reduce a threat to the security of Canada. NSIRA looked to identify and assess:

  • the types of external parties involved in the proposed TRMs;
  • the nature of the information that CSIS shared as part of these measures; and
  • the extent to which CSIS identified, documented and considered the plausible adverse impacts of the measure on individuals.

Types of external parties involved in proposed TRMs

████████████ NSIRA provides examples of the types of external parties involved in proposed TRMs, as well as some of the varied actions they could take in Table 1, below.

*Completed Redacted table*

Nature of information disclosed

████████████ NSIRA examined implemented TRMs to identify the different types of information CSIS shared with external parties. NSIRA observed that the nature of the disclosures varied greatly and also often included information ███████████ linking the subject to threat-related or criminal activity:

█████████████████████████████████████████████████████████████████

█████████████████████████████████████████████████████████████████

█████████████████████████████████████████████████████████████████

███████████████████████████████████████████████████████████████████████████████████████

████████ NSIRA also observed that CSIS used ███████████████████████████████████████████████████████████████████████████████████████ For example, █████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

███████████ NSIRA observed that CSIS’s documentation of the information disclosed to the external party was uneven and, at times, lacked clarity and specificity. █████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ Where the information to be disclosed is vaguely described, the full range of plausible adverse direct and indirect impacts may be difficult to ascertain with any precision. This affects the rigour of any associated risk assessment, including the legal risk assessment.

██████████ By contrast, NSIRA noted certain instances in which CSIS provided a sufficiently detailed description of the information to be disclosed in its documented materials.

██ In NSIRA’s view, the precise content, including the scope and breadth of the information to be disclosed to an external party as part of a TRM, is important and feeds into the overall risk assessment of the proposed measure. A detailed and precise description of the information to be disclosed would allow for more considered assessments.

██ Finding 1: NSIRA finds that CSIS’s documentation of the information disclosed to external parties as part of TRMs was inconsistent and, at times, lacked clarity and specificity.

██ Recommendation 1: NSIRA recommends that when a TRM involves CSIS disclosing information to external parties, CSIS should clearly identify and document the scope and breadth of information that will be disclosed as part of the proposed measure.

Identification, documentation and consideration of impacts

██ NSIRA’s 2020 TRM review examined ██ TRMs where CSIS disclosed information to an external party in order to disrupt a ██████ threat actor. That review underlined the importance of considering all plausible adverse impacts on an affected individual as part of the TRM approval process. In this year’s review, NSIRA sought to examine a larger sample of TRMs in which CSIS disclosed information to external parties to reduce an identified security threat. This year’s review allowed NSIRA to gain greater insight into CSIS’ intended outcomes for these TRMs and how CSIS assessed their impact on the individual.

██ The following examples highlight common impacts that NSIRA identified:

████████████████████████████████████████████████████

████████████████████████████████████████████

████████████████████████████████

██████████████████████████████████████████

██ The interests engaged where measures affect ██████████████████████████████████████████████████████████████████████████████ can have significant and lasting impacts on the subjects and their families. For example, measures that impact the ████████████████████████████████████████████████ interfere with ████████████████████████████████████████████████ Moreover, the associated hardships can affect the subject’s inherent dignity. The norms of our liberal democracy dictate that people in society should be able to █████████████████████████████████████████████

When CSIS is assessing the reasonableness and proportionality of TRMs that can impact the █████████████

as well as assessing whether a warrant is required, it is important that the analysis sufficiently take these factors into consideration.

Measures affecting ███████

███████

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████ In NSIRA’s view, the identification and assessment of the risks associated with ███████████████████████████████████████████████████████████ failed to fully explore the plausible adverse impacts of these actions. ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████

Nevertheless, NSIRA observes that CSIS approved a TRM without knowing the actions, if any, that the ██████████ was required to take under Canadian law or could take, pursuant to its ██████████ This information could have contributed to the assessment of the plausible adverse impacts of the measure upon individuals. ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

Measures affecting ██████████

████████████████████

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

███████████████████████████ NSIRA notes that, at the time the proposed measure was assessed, CSIS did not appreciate the authority and capacity of each of the organizations to prevent the individual from ██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

Measures preventing ████████████

███████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

Measures ██████████████████████████████

█████████████

█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██████████████████████████ While this TRM likely raises issues associated with the extraterritorial application of the Charter, NSIRA focused its assessment on the scope and nature of the plausible adverse impacts of the measure. NSIRA notes that at the time the proposed measure was assessed, CSIS did not have a developed understanding of potential harms ██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██████████████████

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

█████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

Identification of impacts

██ NSIRA observes that CSIS’s understanding of the scope and breadth of the potential ramifications of disclosing information to external parties varied across the reviewed sample. NSIRA expected to see that when CSIS disclosed information to an external party, CSIS had a genuine appreciation of the scope of the plausible adverse outcomes, including the actions that the external party could take. NSIRA also expected to see a consideration of, not only the impacts of the intended outcomes of the measure, but also any collateral adverse impacts.

██ For examples, █████████████████████████████████████████████████████████████████ NSIRA expected CSIS to understand the ability of the external party to take action. As noted in some of the examples above, while CSIS always had a clear desired outcome for the TRM, CSIS did not always have an adequate appreciation of the powers and authority (levers of control) of the external party receiving the information.

██████████████████████████████ NSIRA observed that CSIS had turned its mind to whether the proposed measure could have █████████████████████████████████████████████ However, the identified impacts fell short because they did not consider the foreseeable possibility that the individual could be █████████████

██ Finding 2: NSIRA finds that CSIS does not systematically identify or document the external parties’ authority and ability to take action, or plausible adverse impacts of the measure.

██ Recommendation 2: NSIRA recommends that CSIS fully identify, document and consider the authority and ability of the external party to take action, as well as the plausible adverse impacts of the measure.

Documentation of outcomes

██ NSIRA expected to obtain more certainty with respect to the outcomes of these measures by reading official outcomes reports, ██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ This suggested that CSIS’s reporting system was inadequate or that these reports were improperly filed or non-existent.

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██ NSIRA observes that follow-ups with the external party should be an essential
component of measures involving information disclosure whose principal purpose is to reduce a security threat. Without robust documentation and after action reports on TRMs, CSIS is incapable of assessing the efficacy of the measure as well as appreciating the full impact of its actions. An examination of well-documented afteraction reports will also enable CSIS ██████ to determine whether their initial reasonableness and proportionality assessment may have failed to consider important considerations, which can, in turn, inform the assessments of future proposed TRMs.

██ Finding 3: NSIRA finds that CSIS did not consistently document the outcomes of TRMs in accordance with its policy. Furthermore, CSIS policy doesnot require it to document the actions taken by external parties.

██ Recommendation 3: NSIRA recommends that CSIS should amend its TRM policy to include a requirement to systematically document the outcomes of TRMs, including actions taken by external parties. This practice should inform post-action assessments and future decision-making.

██ Recommendation 4: NSIRA recommends that CSIS comply with its record-keeping policies related to documenting the outcomes of TRMs.

Consideration of impacts when assessing whether a warrant is required

██ The variety of impacts observed in this year’s TRM review highlights the salience of NSIRA’s recommendation in 2020, namely that CSIS consider more comprehensively potential adverse impacts of these types of measures on the affected individuals. This recommendation underlined that all potential impacts on an affected individual, even where they are carried out by the external party and not CSIS, should be consideredwhen determining whether a warrant is required.

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██ This limited consideration of the impacts of TRMs was also evident in this year’s review. ████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████ In an October 2021 briefing between NSIRA and ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██ NSIRA notes that CSIS cannot avoid responsibility just because the outcomes of an action would be effected by someone else’s hand. ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ Where there is a sufficient causal connection between CSIS’s actions and the ultimate outcomes, the principles of fundamental justice apply to deprivations of life, liberty or security effected by external parties. ████████████████████████████████████████████████████████████████████████████████████████████████████████ This is particularly so when such a foreseeable risk has been identified in the reasonableness and proportionality analysis.

██ The current structure used to determine whether CSIS should obtain a warrant for its TRMs is an insufficient implementation of the warrant requirements of the TRM provisions. Sections 12.1 (3.2) and (3.4) require CSIS to seek a warrant when the measure would limit a Charter right or otherwise be contrary to Canadian law. The current ██████████████████ by CSIS is overly narrow and should not be based on the impacts of a CSIS action alone. Rather, it should consider the full impact of the measure, including any direct and indirect impacts caused or initiated by external parties.

██ The CSIS Act is clear that when a proposed TRM would limit a Charter right or freedom, or would otherwise be contrary to Canadian law, CSIS must seek a judicial warrant. In NSIRA’s 2020 TRM Review, CSIS deemed that a warrant was not required for the reviewed TRMs, because it viewed the external party as responsible for taking action, not CSIS. NSIRA identified its concerns with this approach, and noted that consideration of the full impact of such proposed TRMs, including any downstream Charter implications resulting from the external parties’ actions could require CSIS to obtain a warrant before undertaking these types of measures.

██ CSIS’s response to this recommendation stated “the Department of Justice will further consider this recommendation and factor it into its work related to TRM under the CSIS Act.

██████████████████████ However, as noted above, ██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

██ NSIRA fundamentally disagrees with CSIS’s understanding of and approach to the legal analysis of determining whether a warrant is required for proposed TRMs.

██ Going forward, NSIRA expects that when proposing a TRM where an individual’s Charter rights would be limited, or that would otherwise be contrary to Canadian law, whether at the direct hand of CSIS or that of an external party to whom CSIS disclosed information, CSIS will seek a warrant to authorize the TRM.

██ Finding 4: NSIRA finds that when determining whether a warrant is required,CSIS’s assessment is overly narrow due to a failure to appropriately consider the impacts resulting from external party actions.

██ Recommendation 5: NSIRA recommends that CSIS appropriately consider the impacts resulting from external party actions when determiningwhether a warrant is required.

Conclusion

██ The variety of impacts observed in this year’s review, combined with the gaps identified in CSIS’s understanding and assessment of these impacts highlights the salience of a number of NSIRA’s recommendations in 2020.

██ The TRM regime was introduced in 2015 to address an evolving security and intelligence landscape. NSIRA recognizes that CSIS’ threat disruption powers can be an effective tool to diminish a national security threat. While these powers provide CSIS with additional flexibility, they also demand heightened responsibility, given their covert nature and ability to profoundly impact, not only the subject of a given TRM, but others potentially captured by its scope. As this review demonstrates, TRMs can interfere with ███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ Mindful of the need to reduce threats, but recognizing the competing values at stake, it is critical that CSIS subject its TRMs to robust and thorough analyses, both prior to and following their implementation.

██ NSIRA reiterates its recommendation that CSIS consider more comprehensively the plausible adverse impacts of these types of measures on the affected individuals, even when they are carried out by the external party and not CSIS. These impacts should be considered not only when considering the reasonableness and proportionality of a proposed measure, but also when determining whether a warrant is required.

██ In addition, this year’s review again highlighted the importance of Justice’s involvement in the TRM approval process. More specifically, the necessity for Justice to be provided sufficient information, in this case on the nature of the information to be disclosed by CSIS as well as the authority and actions (levers of control) the external party can take, to allow Justice to provide considered legal advice.

██ Finally, without robust documentation and after action reports on TRMs, CSIS is incapable of assessing the efficacy of the measures or appreciating the full impact of its actions. CSIS should systematically identify the actions that are taken by external parties for threat reduction measures that involve CSIS disclosures of information. Identifying and recording these actions and the subsequent impacts on TRM subjects will inform not only TRM risk assessments, but also enable CSIS to build upon its experience with TRMs and guide future decision-making.

██ While outside of the scope of this review, NSIRA is aware that in January 2021, CSIS launched ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ NSIRA may in the future review ████████████████████████████████ and whether it has impacted the identification and consideration of plausible adverse impacts of measures on individuals.

Annex A: Findings and Recommendations

██ Finding 1: NSIRA finds that CSIS’s documentation of the information disclosed to external parties as part of TRMs was inconsistent and, at times, lacked clarity and specificity

██ Finding 2: NSIRA finds that CSIS does not systematically identify or document the external parties’ authority and ability to take action, or plausible adverse impacts of the measure.

██ Finding 3: NSIRA finds that CSIS did not consistently document the outcomes of TRMs in accordance with its policy. Furthermore, CSIS policy does not require it to document the actions taken by external parties.

██ Finding 4: NSIRA finds that when determining whether a warrant is required, CSIS’s assessment is overly narrow due to a failure to appropriately consider the impacts resulting from external party actions.

██ Recommendation 1: NSIRA recommends that when a TRM involves CSIS disclosing information to external parties, CSIS should clearly identify and document the scope and
breadth of information that will be disclosed as part of the proposed measure.

██ Recommendation 2: NSIRA recommends that CSIS fully identify, document and consider the authority and ability of the external party to take action, as well as the plausible adverse impacts of the measure.

██ Recommendation 3: NSIRA recommends that CSIS should amend its TRM policy to include a requirement to systematically document the outcomes of TRMs, including actions taken by external parties. This practice should inform post-action assessments and future decision-making.

██ Recommendation 4: NSIRA recommends that CSIS comply with its recordkeeping policies related to documenting the outcomes of TRMs.

██ Recommendation 5: NSIRA recommends that CSIS appropriately consider the impacts resulting from external party actions when determining whether a warrant is required.

Share this page
Date Modified: