Language selection

Government of Canada / Gouvernement du Canada

Search


NSIRA Review arising from Federal Court’s Judgment in 2020 FC 616

Review Backgrounder

This is a report about the manner in which the Canadian Security Intelligence Service (CSIS) seeks and receives legal services from the Department of Justice (Justice) and prepares and executes the warrants it needs to collect information. This review stemmed from a 2020 decision of the Federal Court (2020 FC 616). In that matter, the Federal Court recommended that a “comprehensive external review be initiated to fully identify systemic, governance and cultural shortcomings and failures that resulted in CSIS engaging in operational activity that it has conceded was illegal and the resultant breach of candour.”

This review found an intelligence service and its counsel who struggle to organize themselves in a manner that allows them to meet easily their legal obligations, including to the Federal Court.

NSIRA also found a failure at CSIS to professionalize fully and sustainably the warrant application process as a specialized trade that requires training, experience, and investment. This report also demonstrates the need to transform the relationship between CSIS and its legal counsel.

This review was led by NSIRA Members Marie Deschamps and Craig Forcese. One or both Members were directly involved in every aspect of the review including review process management, briefings, interviews and document review. To conduct this review, NSIRA conducted dozens of confidential interviews with Justice and CSIS employees whose perspectives were essential for “ground-truthing” the knowledge NSIRA had gained from documents and formal briefings. In organizing these interviews, NSIRA ensured robust representation covering the range of functions in the warrant and legal-advice giving processes. The interviews raised issues and concerns that would have otherwise been unavailable to NSIRA. This assisted NSIRA in making recommendations on governance, systemic, and cultural issues that contribute to inefficiencies threatening the ability of CSIS and Justice to fulfil their mandates.

NSIRA heard repeated concerns from interviewees that the problems stemming from governance, systemic, and cultural challenges put at risk the ability of the intelligence service to meet the mandate Parliament has assigned to it. Addressing these challenges is in the urgent public interest. Though CSIS and Justice have made improvements, difficulties are still evident.

NSIRA groups its findings and recommendations into three overarching areas:

  1. Justice’s Provision of Legal Advice
  2. CSIS’s and Justice’s Management of the Warrant Acquisition Process
  3. Investment in People

In its conclusion, this report also makes comments and recommendations about the broader cultural and governance context.

Date of Publishing:

1. Executive Summary

This is a report about the manner in which the Canadian Security Intelligence Service (CSIS) seeks and receives legal services from the Department of Justice (Justice) and prepares and executes the warrants it needs to collect information. This review stemmed from a 2020 decision of the Federal Court (2020 FC 616). In that matter, the Federal Court recommended that a “comprehensive external review be initiated to fully identify systemic, governance and cultural shortcomings and failures that resulted in CSIS engaging in operational activity that it has conceded was illegal and the resultant breach of candour.”

This review found an intelligence service and its counsel who struggle to organize themselves in a manner that allows them to meet easily their legal obligations, including to the Federal Court.

NSIRA also found a failure at CSIS to professionalize fully and sustainably the warrant application process as a specialized trade that requires training, experience, and investment. This report also demonstrates the need to transform the relationship between CSIS and its legal counsel.

This review was led by NSIRA Members Marie Deschamps and Craig Forcese. One or both Members were directly involved in every aspect of the review including review process management, briefings, interviews and document review. To conduct this review, NSIRA conducted dozens of confidential interviews with Justice and CSIS employees whose perspectives were essential for “ground-truthing” the knowledge NSIRA had gained from documents and formal briefings. In organizing these interviews, NSIRA ensured robust representation covering the range of functions in the warrant and legal-advice giving processes. The interviews raised issues and concerns that would have otherwise been unavailable to NSIRA. This assisted NSIRA in making recommendations on governance, systemic, and cultural issues that contribute to inefficiencies threatening the ability of CSIS and Justice to fulfil their mandates.

NSIRA heard repeated concerns from interviewees that the problems stemming from governance, systemic, and cultural challenges put at risk the ability of the intelligence service to meet the mandate Parliament has assigned to it. Addressing these challenges is in the urgent public interest. Though CSIS and Justice have made improvements, difficulties are still evident.

NSIRA groups its findings and recommendations into three overarching areas:

  • Justice’s Provision of Legal Advice
  • CSIS’s and Justice’s Management of the Warrant Acquisition Process
  • Investment in People

In its conclusion, this report also makes comments and recommendations about the broader cultural and governance context.

CSIS operates in often rapidly evolving and legally challenging environments. Timely, nimble and actionable legal advice is critical. This review highlighted factors that prevent the National Security Litigation and Advisory Group (NSLAG) of Justice from providing CSIS with the operational advice it needs.

Justice has employed a centralized “one voice” model for delivering its legal services. The “one voice” model reflects a desire for uniform and consistent legal advice delivered on behalf of the Attorney General of Canada. Although the premise for the “one voice” approach is sound, NSIRA found that NSLAG struggled to provide timely, responsive, and useful legal advice in the CSIS context. The way Justice provides advice has often not been responsive to CSIS operations. For example, NSLAG presents its advice as a legal risk assessment using the Justice-wide Legal Risk Management grid. This grid uses a colour-coded risk rating that can be compared to a “traffic light” system: a green risk rating represents a low legal risk to CSIS, a red risk rating represents a high legal risk, and, more ambiguously, a yellow risk rating represents an intermediate legal risk. Yellow light responses are reportedly the most common and the most frustrating for CSIS, especially when unaccompanied by discussions on how to mitigate the risk, the inclusion of which NSIRA heard is not currently common practice.

In consequence, some at CSIS perceive Justice as presenting a road-block because of its bureaucracy, its perceived operational illiteracy, and its unhelpful approach to communicating legal advice.

However, the problems with timely, responsive, and useful legal advice do not stem from Justice alone. NSIRA heard that CSIS has not always shared all relevant information with Justice, prompting a degree of mistrust. The internal process for requesting legal advice at CSIS also contributes to delays and lack of relevance. The advice that sometimes comes back to operational investigators at CSIS filtered through bureaucratic hierarchies may be of limited or little relevance.

NSIRA heard that the laborious advice-seeking and -receiving process has sometimes caused [discussion of the detrimental effects on and risks to operations] CSIS and Justice often operate in a situation of legal doubt, because of lack of clarity in the law. Clarifying legal standards often requires judicial case law. However, an unwieldy warrant process, discussed below, makes that prospect more difficult.

Finding no. 1: NSIRA finds that the legal advice-seeking and giving process, and resource constraints at NSLAG contribute to considerable delays, [description of timeline]

Finding no. 2: NSIRA finds that Justice legal opinions have sometimes been prepared without sufficient attention to the audience that needs to understand and act on them. Opinions have been focused on assessing legal risk, often late in the development of a CSIS activity, with limited effort made to propose alternative and legally sustainable means of arriving at the intended objective.

Finding no. 3: NSIRA finds that the Justice Legal Risk Management Framework is misunderstood at the working level at CSIS and further that it does not provide an appropriate framework for the unequivocal communication of unlawful conduct to CSIS.

Finding no. 4: NSIRA finds that difficulties in acquiring prompt and relevant legal advice have contributed to [discussion of the detrimental effects on and risks to operations] that may require legal advice. In consequence, the manner in which Justice has provided legal advice to CSIS does not always meet the needs of CSIS operations.

Finding no. 5: NSIRA finds that Justice does not generate the necessary business analytics to track its service delivery performance to CSIS.

Justice is aware of the need for change. Broad, recent initiatives include the Vision Project, which promises client-centric strategic partnerships. New procedures have been implemented at NSLAG to address internal silos between advisory and litigation counsel, and to improve training, access to legal advice and facilitate consistent legal opinions. NSLAG also appears to recognize the desire for a different approach to providing legal advice, including moving toward legal advice that promotes collaborative and iterative engagement with CSIS to achieve its operational goals, within the bounds of the law (a “road map”-style form of advice-giving). However, it does not appear that CSIS and Justice have thus far systematically put this model into effect.

To facilitate proper advice-giving, especially in a “road map”-style model, CSIS needs to provide NSLAG with all the facts, and to engage NSLAG early on, at the operational level. Earlier and ongoing involvement throughout the stages of an investigation or operation would enable counsel to provide informal legal nudges that allow CSIS to course-correct before too much time has been spent. A more iterative process of incorporating legal advice over the full course of an operation could address the reported challenge of operations halted due to untimely or ambiguous legal advice.

Finding no. 6: NSIRA finds that Justice has acknowledged that internal silos at NSLAG between the advisory and litigation wings have sometimes left warrant counsel unaware of emerging legal issues and that Justice has taken steps to resolve these issues.

Finding no. 7: NSIRA finds that Justice has committed to improve its advice-giving to CSIS, including moving toward “road map” style legal advice that involves working collaboratively and iteratively with CSIS to achieve operational goals within the bounds of the law.

Finding no. 8: NSIRA finds that CSIS has not always shared all relevant information with NSLAG, prompting a degree of mistrust and limiting Justice’s ability to provide responsive legal advice.

In view of these findings, NSIRA recommends that:

Recommendation no. 1: Justice pursue its commitment to reforming the manner of providing legal advice to CSIS, and its stated commitment to “road map”-style advice as a best practice. In support of this objective and the provision of timely, operationally relevant advice, NSIRA further recommends that Justice implement the following:

  • Whether through an expanded “office hours” and liaison counsel program or otherwise, NSLAG must develop a legal support service operating full time, staffed by experienced lawyers empowered to provide operational advice in real time on which CSIS officers can rely, on the basis of settled Justice positions on recurring legal issues, accessible directly to CSIS officers across all regional offices and at all levels.
  • NSLAG develop a concise reference tool with its position on recurring issues and most common legal authorities invoked and make the tool accessible to counsel to support their real-time advice.
  • To minimize the need to resort to the formalized legal advice-seeking process, NSLAG (in coordination with CSIS) must involve counsel with CSIS officers at the early stage of the planning of key or novel operations and throughout their entire operational lifecycle to case-manage an iterative legal guidance process.

Recommendation no. 2: NSLAG (in coordination with CSIS) develop Key Performance Indicators to measure the delivery of legal services to CSIS.

Recommendation no. 3: CSIS and Justice include in their training programs interactive scenario-based training developing the operational intelligence activities expertise of NSLAG counsel and the legal knowledge of CSIS operational staff.

Recommendation no. 4: To ensure Justice is able to give meaningful and responsive legal advice as recommended in recommendation #1, CSIS invite Justice counsel to sit at the table at all stages of the lifecycle of key and novel operations, and that it fully and frankly brief counsel on operational objectives, intent, and details.

Recommendation no. 5: Justice’s advice-giving must clearly and unequivocally communicate advice on the unlawfulness of client conduct, whether criminal or otherwise.

Management of the Warrant Process

CSIS organizes the process of seeking a warrant around a system of internal preparation and approvals before proceeding to the statutory step of seeking ministerial approval of the warrant application. A number of legal concepts and expectations enter into the warrant process, including the “duty of candour” owed to the Court.

The Federal Court duty of candour concerns now fit into two categories: disclosure of information material to the credibility of the sources who supply information used in the application; and disclosure of information material to matters of potential concern about the broader context of the warrant and how it will be executed.

Despite past attempts at reforms the current warrant process adopted by CSIS and supported by Justice, the warrant process has repeatedly failed to meet these candour obligations. Many reforms appear to have contributed to the bureaucratic complexity of the warrant process, without addressing candour issues.

Finding no. 9: NSIRA finds that CSIS has a history of quick reforms, followed by neglect, high turnover of personnel leading to a loss of institutional knowledge, and resourcing that did not match stated priorities. CSIS does not track or measure the outcome of past reforms adequately and has no performance metrics for assessing success.

Finding no. 10: NSIRA finds that CSIS policies have not kept pace with operational reality, as they are often vague, dated, overlapping and contradictory. The absence of clear policy creates legal doubt or concerns, and gives rise to disparate interpretations of legal and operational standards.

Finding no. 11: NSIRA finds that there is little common understanding regarding the process or basis on which a warrant is prioritized. Frequent shifts in this process of prioritization have added to operational uncertainty. The prioritization process has made it very difficult to bring novel issues to the Court with the goal of addressing legal ambiguities through court decisions.

Finding no.12: NSIRA finds that the actors involved in the warrant process do not have a common understanding of the rationale for each of the [multiple] of steps in the overarching warrant application scheme and are not always sure what role each approval step plays.

Finding no. 13: NSIRA finds that the proliferation of process in seeking warrants has created a system of diluted accountability widely regarded as slow and unwieldy, with delays caused by multiple levels of approval.

Finding no. 14: NSIRA finds that there is no regular feedback process in which explanations for warrant-related decisions made at one level filter back to other levels. The absence of feedback is especially acute for the regional investigators.

Finding no. 15: NSIRA finds that often, the sole means to address legal uncertainty is to bring legal questions to the Federal Court through warrant applications. In consequence, an unwieldy warrant process makes resolution of legal doubt more difficult.

CSIS has struggled especially to ensure that all information material to the credibility of sources is properly included in warrant applications. NSIRA heard repeatedly that CSIS officers involved in the early stages of preparing warrant applications do not clearly understand the legal expectations surrounding the duty of candour. Deficient information management systems related to human sources at CSIS have also resulted in important omissions, violating duty of candour obligations. These challenges produce what NSIRA calls the “recurring omissions” problem.

Finding no. 16: NSIRA finds that CSIS has struggled to ensure that all information material to the credibility of sources is properly contained in warrant applications. This “recurring omissions” problem stems from a misunderstanding of the Federal Court’s role in assessing the credibility of sources and from the presence of multiple, siloed information management systems. NSIRA acknowledges that CSIS has undertaken reforms, but work remains to implement successfully long term sustainable solutions.

In view of these findings, NSIRA recommends that:

Recommendation no. 6: CSIS adopt, and share internally, clear criteria for the warrant prioritization process.

Recommendation no. 7: CSIS establish a new warrant process eliminating steps that do not make a significant contribution to a more accurate application. The process should assign clear lines of responsibility for the production of accurate applications. The reformed system should ensure that delays associated with managerial approvals are minimized, and that time is reallocated to those steps contributing to the preparation of the accurate applications.

Recommendation no. 8: CSIS integrate the regional stakeholders (including the implicated investigators) at every key milestone of the warrants process.

Recommendation no. 9: CSIS adopt policies and procedures governing the reformed warrant process that clearly outlines the roles and responsibilities of each participant and the objective of each step in the warrant process and that these policies be kept current as the process evolves.

Recommendation no. 10: To address the seeming inevitability of “recurring omissions”, NSIRA recommends that CSIS prioritize the development of [an improved] system for human source information management. CSIS should also continue initiatives meant to ensure that source handlers are assiduous in documenting and then reporting in source precis information going to credibility. Even with these reforms, the Affiant Unit should adopt procedures for verifying the information prepared by the regions.

In 2019, CSIS sought to professionalize affiant work by creating an Affiant Unit (AU). CSIS’s establishment of the AU is a critical development and, properly resourced and staffed, it would be well positioned to respond to long-standing problems with the duty of candour. However, when created, the AU was placed under the [Name of Branch]. [Name] has a broad mandate that does not align with the AU’s functions in preparing legally robust warrant applications. This governance anomaly may explain the AU’s present administrative and human resource challenges. The AU’s sustainability is in question, and indeed NSIRA heard that the unit could currently be described as in a state of crisis. CSIS has not supported the unit with resources commensurate with the importance of this unit in fulfilling CSIS’s mission.

Finding no. 17: NSIRA finds that the Affiant Unit (AU) constitutes a vital and laudable reform within CSIS. However, the AU is currently at risk of collapse. CSIS has not supported the unit with resources commensurate with the importance of this unit in fulfilling CSIS’s mission. The benefits of the AU are currently in jeopardy because of governance, human resource, and training deficiencies.

Finding no. 18: NSIRA finds that the AU’s placement in the [Name] branch is not commensurate with its functions and importance. This governance anomaly most likely contributes to administrative hurdles and resource challenges faced by the AU.

Finding no. 19: NSIRA finds that without a functional AU able to produce timely and accurate warrant applications, CSIS puts at risk access to warrants and the information collected under them.

In view of these findings, NSIRA recommends that:

Recommendation no. 11: CSIS recognize the importance of the Affiant Unit by assigning affiants and analysts an employment classification congruent with their responsibilities.

Recommendation no. 12: CSIS create an Affiant Branch reporting directly to the CSIS Director.

Recommendation no. 13: CSIS urgently resource the Affiant Unit to meet its responsibilities and ensure its sustainability. In deciding the size of the AU, CSIS should assess how many warrants an affiant team might reasonably complete every year.

Recommendation no. 14: CSIS, in consultation with Justice, develop a comprehensive training course for all affiants and analysts, codifying best practices and methods for members of the AU.

Warrants counsel at NSLAG have several key roles in the warrant application process, and are intimately implicated in ensuring adherence to the duty of candour. Fostering a strong, collaborative, and productive relationship with CSIS is key. Morale among NSLAG warrants counsel may have suffered in light of the recent Federal Court decision that prompted this review. With recent staffing increases, it appears that NSLAG currently has the requisite complement to manage the number of annual warrant applications expected from CSIS, but recruitment challenges remain an ongoing issue. NSLAG should be staffed to ensure that CSIS’s operations are not stalled due to the lack of availability of warrants counsel.

Recommendation no. 15: NSIRA recommends that NSLAG be staffed by a complement of counsel and support personnel sufficient to ensure that CSIS operations are not impeded by resource limitations at NSLAG.

The warrant application process is meant to be strengthened through a review of the near-final affidavit by an “independent counsel” (IC) – in practice, a lawyer drawn from the National Security Group (NSG) of the Department of Justice. The role was originally envisioned as performing a rigorous challenge of the warrant application. However, the primary role of the IC appears to be more clerical than substantive, designed to cite check rather than assertively perform a “devil’s advocate” function.

NSIRA believes that the presence of a rigorous challenge function performed by a knowledgeable, adequately-supported lawyer distant from the warrant application is valuable and necessary. However, NSIRA proposes that the current IC model be abandoned in favour of a challenge function performed at Public Safety Canada, whose precise role is that of oversight of the CSIS warrant application process.

Working with the Public Safety unit charged with warrant review, an experienced and specialized warrant counsel could perform a genuine challenge role to the warrant, analogous to the role a defence lawyer would play were warrants subject to an adversarial process. NSIRA believes that a testing review of this sort will help forestall duty of candour shortcomings stemming from a failure to disclose fully information material to matters of potential concern about the broader context of the warrant and how it will be executed.

Finding no. 20: NSIRA finds that the “Independent Counsel” (IC) role as performed by NSG counsel falls short of creating a rigorous challenge function.

In view of this finding, NSIRA recommends that:

Recommendation no. 16: the function of the Independent Counsel as performed by NSG counsel at the Department of Justice be eliminated, in favour of a new challenge function, analogous to the role a defence lawyer would play were warrants subject to an adversarial process, situated at Public Safety and supported by the Public Safety vetting team, and performed by a knowledgeable lawyer from the Public Prosecution Service of Canada, the private sector, or elsewhere, who is independent from Justice management and not otherwise involved in CSIS warrant applications.

Once a judge issues a warrant, CSIS may execute the warrant. That execution must comply with the scope and terms of the warrant. However, the CSIS regional warrants coordinators have not received sufficient training to enable the contents of warrants to be translated into advice on proper execution.

Finding no. 21: NSIRA finds that the CSIS regional warrants coordinators have not received sufficient training enabling them to translate the contents of the warrants into advice on proper warrant execution.

In view of this finding, NSIRA recommends that:

 Recommendation no. 17: CSIS regional warrants coordinator positions receive adequate training, and that CSIS professionalize the position and enable warrant coordinators to more effectively translate the content of warrants into advice on warrant execution.

Investment in People

Concern about inadequate training at CSIS was a recurring theme in this review. This concern was noted in internal CSIS documents. CSIS acknowledges that it is currently not a learning organization and does not have a learning culture. There are too few training opportunities required to sustain a modern professional intelligence service operating in a complex environment.

Finding no. 22: NSIRA finds that CSIS lacks long-term training programs for Intelligence Officers.

Finding no. 23: NSIRA finds that CSIS has failed to provide systematic training programs for “non-Intelligence Officers”.

Finding no. 24: NSIRA finds that the CSIS’s Learning and Development Branch has not been sufficiently resourced to develop and administer comprehensive training programs, especially in specialized areas not covered by the training offered for Intelligence Officers early in their career.

In view of these findings, NSIRA recommends that:

Recommendation no. 18: CSIS adequately resource and regularly deliver evergreen scenario-based training programs for all CSIS employees, including;

  • annual, comprehensive, warrant training for all operational employees;
  • specialized onboarding training for all employees not part of the Intelligence Officer program; and
  • continued long-term training for all specialized personnel.

Conclusions

This report concludes with observations on cross-cutting cultural and governance challenges that stem, at least in part, from challenges characterizing the provision of legal advice and the warrant process. NSIRA divides these broad, cross-cutting phenomena into two categories: morale and attitudes; and, performing the mission.

Low morale at CSIS was a common theme throughout this review. The systemic problems in the warrant application process are likely one cause of this problem: morale is affected when a warrant acquisition system repeatedly prevents CSIS officers from performing their mandated duties, and is the source of regular reputational crises stemming from failures to meet the duty of candour.

Meanwhile, a failure to correct problems with the warrant process impairs CSIS and Justice’s abilities to fulfill their mandates. Justice must go from being perceived as a roadblock, to a frank and forthright advisor fully attuned to operational objectives.

Within CSIS, the warrant application process was sometimes likened to winning a lottery – not because the Federal Court declines to issue warrants, but because of the resources required to prepare and complete the application. The current, laborious warrant application process is preventing some collection activities from moving forward.

In sum, this review was sparked by a compliance failure in a duty of candour matter. It concludes that repeated failures in this area are both caused by, and cause, deep-seated cultural and governance patterns. This vicious cycle has compounded the challenges of reform in the warrant acquisition process.

Cherry-picked or paper-based reforms that mask without addressing the overarching systemic, cultural, and governance challenges will suffer the fate of prior reforms: the problems will continue.

Finding no. 25: NSIRA finds that CSIS and Justice are at risk of not being able to fulfill their respective mandates. No one reform is likely to succeed unless each is pursued as part of a coherent package. No package will succeed unless backed by prioritization at senior levels, and the stable provision of resources, including people with the means and institutional knowledge to see reforms through, and no reform initiative will succeed unless accompanied by clear performance indicators, measured and analyzed regularly to track progress.

In view of NSIRA’s findings above, and of prior unsuccessful reforms, NSIRA recommends that:

Recommendation no. 19: The recommendations within this review be treated as a coherent package and that progress and outcomes in implementing these recommendations be tracked, allowing management, the Ministers of Public Safety and of Justice, and NSIRA, to assess the efficacy of reforms and course-correct if necessary.

NSIRA intends to launch a follow-up review within two years that will measure progress at CSIS, Justice and Public Safety in resolving the systemic problem with the warrants process addressed by this review. Moreover, in other regular reviews implicating warrants, NSIRA will document recurrences of systemic problems. In the meantime, since this review originated with a decision of the Federal Court, it is vital that the Minister and CSIS share it in its full form with the designated judges of that court.

In recognition of the fact that this report was initiated following a recommendation of the Federal Court, NSIRA in turn recommends that:                                                             

(U) Recommendation no. 20: The full classified version of this report be shared with the designated judges of the Federal Court.

2. Authorities

(U) This review was conducted under the authority of paragraphs 8(1)(a), (b) and (c) of the NSIRA Act.

3. Introduction

(U) This review deals with how the Canadian Security Intelligence Service (CSIS) seeks and receives legal services from the Department of Justice (Justice) and obtains and executes warrants it needs to collect intelligence. In their current forms, these processes suffer from severe flaws due to systemic, governance and cultural issues. In this review, NSIRA found an intelligence service and its counsel who struggle to organize themselves in a manner that allows them to easily meet their legal obligations – towards the Federal Court in particular. NSIRA also found a failure to professionalize fully and sustainably the warrant process as a specialized trade that requires training, experience, and investment.

(U) This is not the first report on issues related to the warrant process. Since CSIS’s creation in the 1980s, there have been several independent and internal reviews of various aspects of this topic, which are described in Annex A. Many of the findings made in this review echo those made in earlier assessments. In response to these reviews, CSIS has planned many reforms, initiated some, but persisted with only a subset. Though CSIS (and Justice) have made improvements, difficulties are still obvious. The failure to effect sustainable solutions following the multiplicity of reviews and duty of candour breaches is indicative of organizational struggles with deep rooted cultural issues that risk the execution of their With each incomplete reform, CSIS faces change fatigue that makes future course corrections more difficult. Yet the stakes are considerable.

(U) This report demonstrates the need to transform the relationship between CSIS and its legal counsel. It also points to the urgency of CSIS succeeding in fully professionalizing the warrant process, a prospect that appears to be in jeopardy. When implemented, the changes that are recommended will help to reestablish the Federal Court’s trust in the warrant process. At the same time, legal support is not – and should not – be limited to the warrant process. As such, the review could not be restricted to the warrant process. It recommends reforms in the manner in which Justice gives legal advice to CSIS.

(U) The Federal Court’s “judicial control” in overseeing the issuance of warrants is a key accountability safeguard in a country governed by the rule of law and attentive to rights and liberties. The warrants the Court issues, meanwhile, are the lifeblood of CSIS’s functions as an intelligence agency – especially in an era where face to face interaction increasingly tends to be replaced by electronic communication.

(U) NSIRA heard repeated concerns from interviewees that the systemic problems rooted in governance and cultural issues risk creating an intelligence service incapable of meeting its intelligence mandate. These problems could also afflict other CSIS mandates potentially subject to judicial control, such as certain threat reduction measures. Urgently addressing challenges is therefore in the public interest. This review aims to recognize and encourage recent progress, while in some areas recommending new, essential reforms.

(U) This report first sets out the background to this review; the methodology NSIRA adopted for it; and the institutional and legal environment in which CSIS and Justice operate. The report then describes issues arising from Justice’s provision of legal advice to CSIS and the manner in which CSIS and Justice construct a warrant application, ultimately presented to the Federal Court, and if granted, executed by CSIS. It also examines the question of training and skills- development, a recurring issue in this review. In each area, this report notes shortcomings, while recommending reforms. The report ends with an examination of cross-cutting cultural and governance issues that are reflected in the warrant process, and which make change difficult.

(U) As the recommendations address the systemic, governance and cultural issues that are interrelated, a selective approach to their implementation will likely lead to the same outcome previous reviews have: repetition of the same problems, change fatigue and morale issues. The time has come for CSIS and Justice to face the harsh reality of potential failure to fulfill their mandates if they do not succeed with concrete governance, cultural and process change.

A. Review Background

(U) This review stemmed from a 2020 decision of the Federal Court (2020 FC 616). In that matter, the Federal Court recommended that a “comprehensive external review be initiated to fully identify systemic, governance and cultural shortcomings and failures that resulted in CSIS engaging in operational activity that it has conceded was illegal and the resultant breach of candour.” As a matter of law, before issuing such a warrant, the judge must believe on reasonable grounds that statutory pre-requisites are met and that the court should allow the invasive CSIS, assisted by Department of Justice lawyers, must fully apprise the judge of all information material to this decision. Thus, the state must disclose to the judge, not just information supporting its application, but also information that weakens its case. The duty reflects the fact that a warrant proceeding is by necessity conducted in the absence of the proposed subject of the warrant, known as the “target”, and closed to the public so the target is not alerted to the state’s activities. The “duty of candour” in such proceedings aims to compensate for the absence of a party opposed to the state, by obliging the state to be especially frank and forthcoming about the merits of its application.

(U) At issue in 2020 FC 616 was whether CSIS should have told the Court about issues regarding the legality of CSIS human source activities that yielded information used in support of warrant applications. Some of these human source activities may have constituted terrorism offences in Canadian This was not the first instance of duty of candour problems – indeed, such problems have been a recurring feature of CSIS’s warrant practice. Because CSIS has repeatedly struggled with the duty of candour in its warrant applications, the Federal Court in 2020 FC 616 recommended an external review of both Justice and CSIS.

(U) In response, on June 23, 2020, the Minister of Justice and the Minister of Public Safety and Emergency Preparedness jointly referred the matter to NSIRA under paragraph 8(1)(c) of the NSIRA Act. NSIRA also chose to exercise its own independent jurisdiction under paragraph 8(1)(a)(b) to initiate this review.

(U) While the Federal Court of Appeal subsequently allowed the government’s appeal of the decision in 2020 FC 616, its holdings did not disturb – and indeed, reaffirmed — the lower court’s core preoccupation with the duty of candour.

B. Methodology

(U) NSIRA conducted this review during a pandemic that frequently impaired access to its facilities housing classified This reality presented challenges and inevitable delays for both NSIRA and the reviewed departments.

(U) NSIRA made this a “Member-led review”. Specifically, one or both of the two assigned NSIRA members (Marie Deschamps and Craig Forcese) managed the review process, reviewed the documents, participated in most of the CSIS and Justice briefings (and reviewed the transcripts of others), conducted most of the confidential interviews, and led the writing of this report. A specialized team at NSIRA participated in every aspect of the work.

(U) NSIRA drafted broad Terms of Reference to govern this review, with a heavy focus on the CSIS warrant application process and the manner by which Justice conveys legal advice to CSIS. As the review evolved, it became clear that the problems with the CSIS warrant process are more properly a symptom of broader systemic, governance and cultural issues at both CSIS and Justice, including Justice’s specialized legal services unit supporting CSIS, the National Security Litigation and Advisory Group (NSLAG). NSIRA therefore examined not only the operational provision of legal advice and the warrant process, but also information management, the use of technology, and related training programs. While the Terms of Reference indicate that the review covers the period of January 1, 2015 to September 30, 2020, NSIRA took into consideration information outside this period in order to fully understand the issues at play.

(U) This report does not revisit the specific circumstances of 2020 FC 616, nor does it conduct a forensic accounting of the events leading to it. From time to time, the report makes observations related to that case in order to contextualize findings. However, this review was intentionally forward-looking, reflecting the fact that CSIS and Justice have introduced (or proposed) reforms since the 2020 decision.

U) In conducting this review, NSIRA relied on both its regular process and confidential interviews. Under its regular protocols, it issued a number of requests for information, reviewed the documents provided, and received briefings from CSIS and Justice. In the case of CSIS, NSIRA also used its direct access to CSIS systems to retrieve information independently. Among other things, NSIRA examined the complete record of a recently filed complex warrant application. Most briefings involved CSIS and Justice managers describing their policies, governance structures, and practices. NSIRA heard about a number of initiatives – some that are planned, others underway or partially implemented, and still others abandoned.

(U) To supplement these briefings, NSIRA adopted an innovative approach to this review by also conducting dozens of confidential interviews with former and current management and staff at all levels from CSIS and Justice. These interviews were conducted in the absence of CSIS or Justice supervisors and without their knowledge. NSIRA conducted these interviews under a strict guarantee that it would protect the identities of those who participated. At the outset, the NSIRA Members leading the review met with both the Director of CSIS and the Deputy Minister of Justice. Following the meeting, both officials encouraged members of their management and staff to participate in confidential, in-person interviews with NSIRA. NSIRA thanks both leaders for their explicit support, including through their internal communications with their employees. NSIRA especially thanks all the individual employees who then participated in these confidential interviews and trusted NSIRA’s promise of anonymity.

(U) In some instances, NSIRA selected individuals to ensure it had full coverage of the warrant process and invited them to participate in a confidential Other interviewees contacted NSIRA and offered to participate. Some interviewees occupied operational positions at CSIS, while others worked on legal and policy matters. Some interviewees had daily exposure to the warrant process, while others had had more episodic exposure to the process. Since NSIRA conducted these interviews with the understanding it would protect the identities of interviewees, NSIRA has drafted this report carefully to honour this undertaking and has not identified interviewees by name or by position revealing their identity.

(U) The individuals who participated in confidential interviews with NSIRA were frank, professional, insightful about their experiences, and open. Interviewees did not come to voice personal grievances, nor were they inclined to defend past practices as ideal. Rather, the interviewees displayed a genuine commitment to their organizations’ mandates and a sincere desire to see positive, lasting change. Where they expressed dissatisfaction, it stemmed from earnestly (and often deeply held) concerns that their organization was falling short of meeting its mandate, and that the warrant process reflected certain organizational shortcomings. These interviews were essential for “ground-truthing” the knowledge NSIRA had gained from documents and formal They also raised issues and perspectives that would otherwise have been unavailable to NSIRA.

(U) NSIRA also consulted external experts on national security, organizational development, and human resources. These conversations contributed to NSIRA’s understanding of the systemic, governance, and cultural issues that often develop in organizations. NSIRA conducted a small number of discussions with foreign counterparts who have dealt with similar issues in the past. In addition, NSIRA consulted with experts who had been, in the past, involved in reviewing similar issues relating to NSIRA is grateful to these experts for their generosity in contributing to this review. All of NSIRA’s discussions with stakeholders external to the Canadian government took place at the unclassified level.

(U) Finally, as part of its standard protocol, NSIRA presented the draft report to both CSIS and Justice for factual accuracy verification. This part of the process provides reviewees with the opportunity to signal factual omissions or errors, if any. At the end of the factual accuracy verification period, the members met with the Deputy Minister of Public Safety and again with the Director of CSIS and the Deputy Minister of Justice. NSIRA thanks them for their time and

When examining the insights of its interviewees and throughout the finalization of this report, NSIRA was alive to the particular challenge of disaggregating legacy issues from contemporary concerns. During briefings and in comments received on the draft report, the departments noted projects, initiatives and reforms either being planned, scheduled for execution, or underway. NSIRA acknowledges the initiatives upon which it was briefed. However, this report focused on ascertaining the existing challenges with the provision of legal advice and the warrants process. NSIRA did not discount existing issues and challenges simply on account of promised (but not yet fully achieved) administrative reforms. NSIRA is confident that the issues described in this report persist as of the second half of 2021. As described at the end of this report, NSIRA intends to undertake a further review in two years’ time to assess progress in implementing the report’s recommendations. At that time, NSIRA will have an opportunity to assess whether any reform initiatives have been successful.

(U) Confidence Caveat: Some of the documents provided by the reviewed institutions have not been independently verified by NSIRA. However, to a large extent, NSIRA was able to verify much of the information relied upon in this review through NSIRA’s own confidential interviews. In addition to this direct access to staff, NSIRA was able to use its direct access to CSIS information repositories to confirm information that it needed to verify and to pursue necessary additional For that reason, NSIRA has a high level of confidence in the information on which it relied to complete this review.

C. Institutional Environment

1. Systemic, Governance and Cultural Issues

(U) In this review, NSIRA makes recommendations on systemic, governance, and cultural issues that contribute to inefficiencies and may threaten the ability of CSIS and Justice to fulfil their mandates.

(U) NSIRA defines “systemic” issues as ones affecting an organization as a whole, in the sense that they are not the consequence of a specific individual or isolated factor. “Governance” refers to the rules, practices and processes by which managers direct and control an organization. Governance addresses three key questions: how are decisions made; who makes the decisions; and who is accountable. Organizational “culture” is the way in which, over time, the members of an organization learn to work in a particular setting by developing a set of shared understandings. These understandings may be based not only on formal policies but also on assumptions and practices that members develop in response to the implicit rules and influences governing their organization.

(U) These three concepts operate together and are interconnected. For example, inadequate governance may be the source of deficiencies in training programs that may prompt increased requests for legal support, which in turn create resource management issues, delays in providing advice, and operational hurdles. These operational challenges may give rise to systemic issues, while imperfect workarounds to these problems may eventually become embedded as cultural practices.

(U) Systemic issues tied to governance and cultural issues may impede CSIS and Justice from fulfilling their mandates, while also meeting their obligation to adhere to the rule of law. In this last respect, Canada is a “rule of law” country. Among other things, the “rule of law” means that the state is subject to, and not above, the law. It only has the powers conferred upon it by law, and any exercise of state power must be traced to a law. Indeed, as discussed next, both CSIS and Justice operate in a highly legalized environment.

(U) The next section will briefly describe the basic legislative and operational framework of both CSIS and Justice.

a) CSIS

(U) The CSIS Act is the statute of Parliament that created CSIS, and confers upon CSIS certain powers to discharge its mandates. The key mandates implicated in this review are security intelligence (or “section 12 investigations”) and foreign intelligence (or “section 16 investigations”). Both of these types of investigations have their own distinct pre-requisites – not least, the conditions that CSIS must meet before it undertakes an investigation and then applies for a warrant under section 21.

(U) CSIS is one of several security organizations found within the portfolio of the Minister of Public Safety and Emergency Preparedness (Minister of Public Safety). CSIS is accountable to this minister, and this minister is in turn responsible to Parliament for CSIS.

(U) The manner in which CSIS discharges its mandates is governed by the CSIS Act and Ministerial Directions issued by the Minister of Public Safety. For instance, in 2015 and 2019, the Minister issued Ministerial Directions addressing issues of accountability. The 2015 Ministerial Direction (2015 MD) for Operations and Accountability states the fundamental principles that guide all of CSIS’s The 2015 MD is premised on the expectation that “the service will perform its duties and functions with due regard for the rule of law…”

(U) Other laws are pertinent to CSIS. Especially relevant for this review are Part VI of the Criminal Code of Canada, which governs the interception of private communications, and section 8 of the Canadian Charter of Rights and Freedoms, which protects the reasonable expectation of privacy against state searches and seizures. CSIS must acquire judicial warrants from the Federal Court before it embarks on investigative techniques that would otherwise violate these laws.

(U) Under the CSIS Act, CSIS is led by a Director who holds the status of deputy head of the organization. The Director performs the leadership function assisted by a team of executives responsible for specific business lines within CSIS, including the Deputy Director Operations (DDO). The DDO is responsible for CSIS’s operations across all active investigations. The CSIS management structure also includes an Assistant Director Legal (ADL), a position occupied by the NSLAG’ Executive Director (discussed below).

(U) CSIS converts legal requirements into administrative processes through Critically, it has struggled to do so. The CSIS operational policy suite has been incomplete and out-of- date for a number of years, a finding noted repeatedly by both NSIRA’s predecessor, SIRC, and by NSIRA. This issue was again pervasive in the course of this review, making it difficult to precisely describe the formal operational policy environment applicable to the warrant acquisition process throughout the period covered by this review. The consequences of this shortcoming are considerable. Policies are the building blocks of any organization. They guidethe conduct of its members from the bottom up to the senior leadership. Without clear policies, employees are likely to devise their own interpretations of how to act and of the limits of their powers, causing confusion and making legal compliance difficult.

b) Justice and NSLAG

(U) The Department of Justice provides legal services to departments and agencies on a broad range of issues across the federal Its mandate is to support the dual roles of the Minister of Justice and the Attorney General of Canada (AG).

(U) The Minister of Justice, as the official legal advisor to Cabinet, is responsible for the general management and direction of the department, and for ensuring that the administration of public affairs is in accordance with the The Minister is responsible for matters related to the federal administration of justice. The Minister exercises political judgment, except when providing legal advice, which must be independent and non-partisan.

(U) The Minister is also ex officio the AG, also referred to as the Chief Law Officer of Canada. The role of the AG is to provide legal advice and legislative services to government departments and agencies, and to conduct litigation on behalf of the government. Importantly, the AG represents the Crown and not individual departments or agencies, and therefore seeks to protect whole-of-government interests. Although departments generally act as the instructing clients, it is the Attorney General’s responsibility to facilitate, with these departments, adherence to the rule of law.

(U) The Deputy Minister (DM) of Justice, who is also the Deputy Attorney General of Canada, manages the work and operations of the department as its most senior public servant. The DM is supported by an Associate Deputy Minister who is entrusted to lead some of Justice’s specialized portfolios. This includes the Public Safety, Defence and Immigration (PSDI) Portfolio which is led by an Assistant Deputy Minister reporting directly to the Associate Deputy Minister.

(U) Justice delivers legal services to federal departments and agencies through a mix of three models, all of which apply to CSIS: (1) specialized centers of expertise, within the department; (2) a network of regional offices located across the country; and (3) dedicated legal service units (LSUs) that are physically located with the departments they advise.

(U) LSU counsel provide day-to-day advice on all issues. LSU counsel may consult or collaborate with counsel from the specialized branches, or at other LSUs as needed. Although co-located with client departments, LSU counsel are Justice employees, and in keeping with the status of the Attorney General, must remain independent from the client.

(U) The National Security Litigation and Advisory Group (NSLAG) is the LSU that supports and advises CSIS. It is located at CSIS headquarters and is part of the PSDI Portfolio. With approximately 50 counsel positions, NSLAG is led by an Executive Director and Senior General Counsel who reports directly to the Assistant DM of PSDI. The two meet every two weeks to discuss NSLAG’s work. The ADM, in turn, must report any matters of concern to the Associate DM.

(U) As mentioned previously, NSLAG’s Executive Director also occupies the position of ADL within the CSIS executive structure, reporting to the Director. Justice described this reporting relationship as functional only. In the ADL role, the head of NSLAG has confidential, bilateral meetings with the CSIS Director, to provide briefings on legal files and discuss issues that arise. This functional reporting relationship to the client co-exists with the formal reporting relationship within While at first glance this functional reporting role might seem to pose a challenge in terms of maintaining full independence from the client, Justice asserts that this structure is not unique to CSIS and does not create concerns regarding client capture.

(U) NSLAG provides both advisory and litigation services to CSIS on its security and intelligence Its advisory work involves matters related to the duties and functions of CSIS, including questions of legal authority, and advice related to the Charter, threat reduction measures, and the application of other legislation to CSIS operations. NSLAG’s litigation work consists mainly of representing CSIS in applications for warrants before the Federal Court and related matters, and representing both CSIS and other government departments and agencies in complaints investigations before NSIRA.

(U) CSIS also receives legal services from the National Security Group (NSG), a specialized legal branch located at Justice’s headquarters. As part of the AG’s National Litigation Sector, NSG leads the litigation of claims related to national security privilege under section 38 of the Canada Evidence Act. Its counsel are security cleared at the Top Secret level. NSG counsel also play a role in the CSIS warrant application process – namely, to conduct an “independent challenge” exercise as part of the internal approval process for warrant NSG’s role as Independent Counsel (IC) in the CSIS warrant application process is discussed in section 4e below.

(U) While the basic legislative and operational framework may seem simple, a closer analysis sheds light on many ongoing issues.

4. Analysis

(U) This review revealed governance and cultural challenges in both CSIS and Justice that contribute to systemic issues in the warrant process, including with respect to the duty of candour. NSIRA’s findings fall within three overarching areas:

  • Justice’s provision of legal advice;
  • CSIS and Justice’s management of the warrant acquisition process; and
  • Investment in people in terms of training.

The report concludes with comments on systemic, governance and cultural issues.

(U) In order to meet its obligations with regard to the rule of law, CSIS must know what the law is. An unwieldy, tardy or indefinite means of ascertaining the lawfulness of activities jeopardizes CSIS’s ability to fulfill its mandate while adhering to the rule of law. This review considered, therefore, the fashion in which Justice (and specifically, NSLAG) provides legal advice to CSIS in performing its mandated activities, and how it has organized itself to do so. NSIRA noted three specific issues: the bureaucratic manner of obtaining advice; its timeliness; and the usefulness of this advice to CSIS in meeting its mandate.

1. Giving Advice to CSIS

(U) CSIS operates in often rapidly evolving and legally challenging environments. Timely, nimble and actionable legal advice is critical. To meet these objectives, Justice has adopted “operating principles”, including a centralized “one-voice” model for delivering legal In this model, Justice counsel are described as speaking “with one voice”, reflecting a desire for uniform and consistent legal advice delivered on behalf of the AG. To this end, Justice seeks consistency in the legal advice provided and the legal positions taken across Justice, to ensure a “whole-of-government” approach. Its advice does not simply reflect the opinion of the assigned legal counsel. Rather, the advice provided has “all of Justice behind [it]”.

(U) The one voice approach responds to a prior era in which many federal government departments hired their own lawyers to provide them with legal These lawyers were not part of Justice. When difficult, cross-governmental legal issues arose, counsel representing the various ministries did not always agree, which would then place the AG in a difficult position in Cabinet. A decision was made to bring all such departmental lawyers together in a common legal service operating under the Justice umbrella.

(U) In support of its one voice approach, Justice now employs a number of tools, including:

  • establishing centers of expertise within Justice to provide consistent, “government-wide” advice, primarily to Legal Services Units, in key areas of public law, such as constitutional law, human rights law, and information and privacy law;
  • maintaining a legal knowledge portal called “Justipedia” to serve as a single, national, searchable repository for all legal opinions from Justice’s services;
  • fostering discussion of legal issues at various committees, such as the national and regional litigation committees and other ad hoc committees;
  • convening working groups to determine legal positions;
  • creating practice groups to exchange and share relevant knowledge; and,
  • applying a common legal risk management (LRM) framework when providing advice to client departments and agencies.

(U) While the premise for the one voice approach is sound, this review has noted some disadvantages in the current implementation of the model in the CSIS context. Importantly, because of the bureaucratic process required to complete a legal opinion, obtaining legal advice can be burdensome, inefficient, and a source of undue delay. Hierarchies in both CSIS and Justice have impeded fluid collaboration between Justice counsel and their CSIS client by limiting counsel’s ability to deliver advice rapidly. The pace of legal advice-receiving from Justice is slower than a CSIS intelligence operation, which leads to the advice not being delivered in a timely manner and in CSIS being [discussion of how collection activities are affected]

(U) In addition to the challenges of timeliness associated with bureaucratic hierarchies, there are also communication challenges associated with the different knowledge base involved in legal analysis versus operational expertise. NSIRA noted several critiques. Interviewees urged that Justice counsel would benefit from a greater understanding of CSIS’s operations. It was suggested that new or junior lawyers could participate in key operational training sessions to gain a better understanding of the CSIS Some discussed current initiatives to cultivate greater understanding between Justice and CSIS, voicing skepticism about their success. For instance, Justice was said to pitch its “lunch and learn” sessions with CSIS at the wrong level, and is too esoteric and theoretical when discussing, for example, section 8 of the Charter. Legal training of CSIS employees conducted by inexperienced counsel was also identified as a problem.

(S/C) These complaints are consistent with a 2018 client feedback survey on CSIS legal advisory That survey measured four dimensions of its service in comparison to those of the overall PSDI Portfolio. The survey found the overall quality of legal advisory services fell slightly below the departmental target, landing in the “moderate” category, with similar ratings from CSIS on the overall accessibility and responsiveness, as well as usefulness of its legal services. The survey results demonstrated satisfaction with legal risk management, which met the target standard. On the issue of timeliness, however, Justice scored poorly. Justice concluded that the survey indicated that CSIS users were, by and large, somewhat unsatisfied with the services provided and that there was room for improvement. Some comments from CSIS consistent with those frequently echoed in the interviews conducted by NSIRA included:

  • “I don’t get the impression that DOJ lawyers working within my organization actually comprehend what we do.”
  • “Responses take too long. Has impact on our operational abilities.”[discussion of how collected activities are affected]
  • “Justice staff were adept at pointing out…legal risks associated with initiatives, but were not adept at providing practical advice to mitigate risk (other than recommending cessation of the initiative)”
  • “There seems to be a lack of coordination.”

(U) The following sections describe more detailed and pointed CSIS preoccupations with the manner by which its officials seek advice from Justice and about the nature of the resulting advice.

a) Obtaining Advice

(U) Barriers to accessing legal advice were a common theme of interviews. CSIS must formally frame its questions as clearly as possible, to avoid “half-baked” inquiries. However, rather than a collaborative process between counsel and CSIS, the conventional advice- seeking system is a formalized, bureaucratic process. Formal advice requests generally appear to be funneled from CSIS investigators and related personnel in the regional offices through their hierarchies, sometimes (but not usually) up to headquarters, and then from there to Justice counsel.

(U) This process, and resource constraints at Justice, contribute to considerable delays, [description on timeline]. Apart from prioritized, urgent requests for legal advice, it can take [timeline] to receive legal advice. In situations involving novel or complex issues, advice may take [timeline].

(U) Once prepared, advice then filters back through the same hierarchy, sometimes never reaching the investigators in its full form. Some interviewees reported concerns about “broken telephones” in which advice requests morphed in their travels through the hierarchy without an iterative process between counsel and the investigators seeking the advice, resulting in legal advice of limited relevance.

(U) Since this conventional process implicates both CSIS and Justice, it can be difficult to ascertain how much of this reported delay stems from Justice’s advice-giving mechanics and how much from CSIS’s own internal bureaucracy. Moreover, statements by interviewees estimating delay in receiving advice are hard to corroborate since NSLAG does not track the time it takes to provide its advice. The absence of such data at Justice raises a separate issue of whether it is in a position to measure progress and improvements stemming from any reform initiative.

 (U) Regardless of precise cause, the lack of clear timely advice has reportedly had considerable impact on CSIS operations. With an increase in electronic communication and information, the need for timely, clear advice on investigative methods has become pivotal. The operational impact is notable: interviewees repeatedly described an [discussion of detrimental effects on operations] that may require legal advice. Managers have reportedly sometimes advised staff to seek alternative solutions where a matter may require legal advice [discussion of detrimental effects on operations]

(U) Clearly, the conventional legal advice process does not adequately support CSIS operations, both in terms of timeliness and relevance.

 (U) In addition to timeliness and relevance, NSIRA heard regular and often related concerns about the nature of the legal advice supplied by NSLAG to CSIS. NSIRA interviewees repeatedly described legal opinions pitched at an esoteric and legalistic level, without sufficient attention to the audience that needs to understand and act on them.

 (U) NSLAG has typically presented its advice as a legal risk assessment, in which NSLAG opines on the risk associated with a specific activity, in accordance with the Justice Legal Risk Management (LRM) Framework, described further below. The style of the resulting advice can be compared to a “traffic light” system, where an activity represents a low legal risk to CSIS (green light); a high legal risk (red light); or, more ambiguously, an intermediate legal risk (yellow light). Yellow light-style responses were reportedly the most common and the most frustrating to consumers of the advice, especially when unaccompanied with discussions of how risk could be mitigated.

(U) In this last respect, CSIS interviewees often described NSLAG opinions as not making efforts to propose alternative and legally sustainable means of arriving at the intended objective. That is, NSLAG reportedly does not always understand CSIS’s objectives, and then provide advice designed to guide CSIS on how it might lawfully meet that objective (if possible). Several CSIS interviewees emphasized the potential value of having Justice assist them by providing advice in the form of a “road map” to how an operation might reach its objective lawfully. They stressed, however, that this road map-style form of advice was not a regular part of the NSLAG advice-giving approach or practice culture. That said, NSIRA also heard that there may now be the beginnings of a shift from the conventional advice-giving approach, as discussed below. Because of the importance NSIRA places on it, this report returns repeatedly to the concept of road map-style advice.

(S) NSIRA heard that in instances where CSIS managers received advice indicating a medium level of risk (yellow light), they often [description within CSIS of an unwillingness to accept risk]. In other instances, managers expressed discomfort with assuming the risk and reportedly forwarded the decision up the hierarchy to diffuse responsibility. Operationally, such delays in decision-making often have detrimental effects on investigations.

(U) As a result, some at CSIS perceive Justice as presenting a road-block. This is not because Justice provides principled and clear positions reflecting the primacy of the rule of law over ill-advised operations, but rather as a result of the bureaucracy at Justice, its perceived operational illiteracy, and its unhelpful approach to communicating legal advice.

(U) There is, however, another dimension to these issues. Justice, and NSLAG especially, face challenges in giving advice to CSIS. Justice is not directly analogous to a private sector law It must perform a public law function tied to the roles of the Minister of Justice and the AG. In giving its legal advice, Justice must be especially attentive to the rule of law and the AG’s role in defending it.

(U) When interacting with its clients, Justice acts merely as an advisor and sees it as its client’s responsibility to make the ultimate decision, informed by the advice given. A factor that may explain Justice’s resistance to go beyond pure legal analysis is that Justice is necessarily wary of a reported tendency by CSIS to recast legal questions in an effort to get different answers. CSIS, it was said, sometimes resists the law as it is, hoping that the law will be what it wants it to be.

(U) Additionally, NSIRA heard that CSIS has not always shared all relevant information with Justice, prompting a degree of mistrust. NSIRA heard of instances in which CSIS provided Justice with partial information, but did not convey the full NSLAG has informed CSIS that to provide the most meaningful legal advice and to better support its operations, counsel need to have “all the facts”, and to be engaged “sooner and deeper”. NSLAG conveyed that earlier and ongoing involvement throughout the stages of an investigation or operation, with participation in CSIS meetings and discussions along the way, would enable counsel to gather facts more naturally, and permit a more nuanced understanding. If there is uncertainty as to the client’s true goals and current situation, it is understandable that Justice lawyers are sometimes reluctant to provide a road map.

(U) The provision of advice on highly classified matters also presents logistical challenges. NSLAG lawyers operate in an environment that may impede easy interaction with other components of Justice, including in the specialized practice groups, where top secret security clearance holders are few and information management systems are not approved for classified information storage. Further, Justice is not well structured to address the range of matters arising in national security, and other units may produce advice that is too late, or unhelpful. Specialized units struggle where they are excluded from relevant classified information, and have sometimes been consulted by NSLAG too late in the advice process. The process by which differences of opinion between these specialized groups and NSLAG are reconciled would appear not to be fully formalized. There are some joint committees, and strong disagreement on a high profile matter could be advanced to the deputy minister. It is unclear how much these processes are leveraged to overcome the identified challenges.

(U) Internal silos at NSLAG between the advisory and litigation wings also play a role. These internal silos were reportedly a contributing factor in the confusion and uncertainty surrounding the omission of information in the warrants in 2020 FC 616. Many of the unlawful activities at issue in that case involved sources and operations for which legal advice had been previously discussed within NSLAG in the advisory branch, where relevant opinions on matters such as crown immunity had been produced. However, warrants counsel reportedly were not always aware of this The breakdown of internal silos is thus essential for the avoidance of such sequences of events in the future.

 (U) Moreover, CSIS’s activities are sufficiently unique and unusual to impose a steep learning curve on counsel. This learning curve manifests itself in several ways. First, NSLAG lawyers must become familiar with the unique and classified CSIS operational environment, something that some interviewees on the CSIS side suggested counsel needed to better understand. Second, novel questions may require careful and collective consideration, ensuring that Justice “speaks with one voice” but also slowing the process of delivering advice.

(U) Finally, Justice cannot easily overcome the inherent uncertainty of some legal issues, and Justice lawyers may often be obliged to voice legal doubt; that is, the unhelpful “yellow light” concept. Legal doubt is anathema in a rule of law system – it is difficult to ask an organization to comply with a law when that law is unknown. The law in national security can be especially unsettled. The sometimes imprecise statutory law applicable to CSIS is rarely subject to judicial interpretation, creating considerable uncertainties. Meanwhile, case law on section 8 of the Charter mostly arises in the criminal law context, and Justice counsel are left to extrapolate from these decisions to the related, but still distinct world of CSIS operations. Often, the sole means to address legal uncertainty is to bring legal questions to the Federal Court through warrant applications.

(U) In sum, national security law is a highly specialized and constantly developing area. Nonetheless, CSIS needs efficient advice, a need that goes to the heart of both CSIS and Justice’s mandates.

2.    Reform Initiatives

This section addresses recent reform initiatives in the delivery of legal services at Justice.

a) NSLAG’s Recent Internal Protocols

(U) Justice told NSIRA that it is aware of the need for change in the organizational culture at NSLAG.A new NSLAG Executive Director took office in January 2020 and, since then, has reportedly participated in senior-level discussions with CSIS on cultural change management. NSLAG noted some resistance to change management within its organization, but reported a generally healthy appetite for change, including with an aim of addressing concerns about information silos.

(U) NSLAG has implemented several new internal procedures addressing internal silos by facilitating awareness among litigation counsel on emerging legal issues on the advisory side (and presumably vice versa). NSLAG has developed its own classified version of Justipedia to assist with knowledge management, with the aim of ensuring consistent legal opinions. NSLAG holds weekly practice group meetings in which participants provide “roundtable” updates on their work. If a practice group is unable to sort out a legal issue, the matter may escalate through several levels of management within NSLAG, to the Executive Director. While these reforms may assist in bridging internal silos, they may not be sufficient. NSLAG must develop a process whereby there is a method to communicate with, or brief warrant counsel where advice has been provided for an operation that subsequently becomes prioritized for a warrant.

(U) Justice sometimes issues practice directions to provide guidance to counsel on certain aspects of their practice. In 2019, Justice issued two practice directions related to the duty of candour in warrant applications. The first specified that warrant applications will not rely on information derived from unlawful activity, and where unlawful activity occurs, it must be brought to the Court’s attention. The second provided guidance on information that must be disclosed to the Court, including whether the human source has engaged in illegal activities, as well as issues that inform the credibility and reliability of a source.

(S/C) On September 22, 2020, Justice issued a practice note to NSLAG counsel [Description of contents of note]

(S) Not all interviewees thought these changes would suffice to address NSLAG’s internal silos, and worried that dots would not be connected between legal advisory opinions and operational legal One suggestion was to ensure that relevant advisory opinions are [IM solution suggested]

(U) Moreover, NSLAG’s range of expertise may not suffice to identify every latent legal issue. In addition, those components of Justice with that capacity may not appreciate the nature of CSIS’s mandate and operations. Some interviewees urged NSLAG’s litigation role needs to be supplemented by working more closely with Justice’s general litigation lawyers in their counsel role,80 requiring that information silos be overcome. NSIRA notes Justice recently implemented tools specific to its national security role. These include a number of DM-level committees that address broad policy and operational matters in national security and which involve other LSUs.

(U) NSIRA observes that Justice’s capacity to anticipate new issues depends on an alert client. Interviewees described an effort to be more proactive, and to raise to the CSIS Director legal issues requiring proactive resolution.  At a minimum, it will be important for the Director to work with Justice and Public Safety Canada to anticipate emerging legal issues, and organize effective means of resolving them.

b) Renewed NSLAG and CSIS Relations

(U) NSLAG acknowledged the need “to do a better job ensuring that the client understands the legal landscape”. It recognized client frustration with the law in some circumstances, since court cases may provide direction that is sometimes confusing in real world situations, including with respect to Charter issues and a person’s reasonable expectation of privacy. Although it does conduct some training for CSIS, NSLAG says it could be doing more outreach and engagement. As part of CSIS’s Project  [Name], discussed further below, NSLAG has indicated the need for more outreach training in both directions, including CSIS providing training for NSLAG.

(U) NSLAG also appears to recognize the desire for a different approach to giving advice, including moving toward road map-style legal advice that works collaboratively and iteratively with CSIS to achieve operational goals within the bounds of the law. NSIRA heard that NSLAG regards this approach as a best practice and is committed to it, although it was not clear at the time of the review how far Justice had moved toward a generalized, road map-style form of advice-giving.

(U) It was clear, however, that Justice generally does not support a solution of “embedded” legal counsel at CSIS regional offices. Justice interviewees regarded embedding as raising risks of client capture and posing challenges for internal staffing and consistency of advice. Instead, Justice and CSIS have recently launched a pilot project in which specific counsel were designated to support CSIS throughout a specific operational ‘mission’.

 (U) Moreover, NSLAG has piloted an “office hours” practice, relying on headquarters-based counsel serving as liaison counsel for the regions. Those regional liaison counsel who currently provide support make themselves available to the regions to receive informal queries. The office hours initiative was conceived as a means of permitting CSIS personnel to put forth “trial balloons” regarding operational possibilities before possibly formulating a request for formal legal advice, which would then be put through the conventional advice request process.

(U) NSIRA also heard that a revamped approach to the giving of advice would require cultural adjustments at both CSIS and Justice. The Justice practice of vetting advice through a hierarchy may be difficult to reconcile with more timely legal involvement. Novel questions may require careful and collective consideration, ensuring that Justice “speaks with one voice” but they will need to be mindful that delay may jeopardize operation or reach a point of uselessness. As noted, short of converting CSIS officers into legal experts, regular and timely access to legal advice is essential to meeting the standards of the rule of law without stymying operations. NSIRA would also note that even formal legal advice will need be geared to the consumer, and thus should avoid legalistic discussions largely meaningless to non-lawyers.

(U) In moving toward such a system, NSLAG will need to avoid client capture in order to meet the Attorney General’s obligation to honour and advance adherence to the rule of law, while also facilitating CSIS’s operational imperatives. A dominant theme of the interviews was the challenge of reconciling the Attorney General’s obligation to maintain the rule of law with client-centered service delivery models giving clear and consistent legal advice to CSIS in the execution of its lawful mandate. Lawyers do not easily reconcile these objectives, and interviewees were of the view that clearer instruction on the role of the AG and codified standards for giving advice were advisable. Thus, NSIRA heard support for the idea that NSLAG should have advisory service standards. Such standards are especially important if, as NSIRA heard, at the more senior levels in Justice, the border between legal advice and policy advice may begin to blur. Some interviewees indicated that at this level, there can be a strong cultural desire to give the client room to maneuver.

(U) For its part, CSIS will need to become more comfortable working closely with legal advisors, and in disclosing the full range of sensitive details needed for Justice counsel to provide useful advice. Generally, CSIS interviewees seemed to welcome the office hours approach, though some noted its usefulness will be dependent on the personality and experience of the counsel, and in any case, it is not a panacea. This reaction highlighted the reservations of some CSIS officers based on past unsatisfactory interactions involving inexperienced counsel.

c) Additional Steps at NSLAG

(U) Justice faces, therefore, the ongoing challenge of giving fearless, timely, consistent and clear legal advice while at the same time developing client-centered service models, in an area (national security) that is a niche, often highly-specialized concern for the department and fraught with legal uncertainties.

(U) In assessing current initiatives in future reviews, NSIRA will be especially concerned with how Justice embraces a road map-style of advice-giving. Based on the information collected for this review, NSIRA believes that useful advice must be offered during operational planning and execution, a prospect that NSIRA expects the pilot project involving an operational mission will explore. Advice should continue as the operation is evolving in response to unforeseen legal matters requiring immediate guidance. Based on its interviews, NSIRA believes the success of this system will depend on a number of features. First, the optimal delivery of legal services must rely on Justice counsel who are sufficiently experienced and attuned to the unique CSIS operating environment. While not embedded in the regions, it seems these counsel will need to be entrusted with the ability to interact directly with CSIS operational clients at all levels, including during live operations, and give advice on routine matters without delay. These counsel will also need to be familiar with Justice’s position on recurring issues so as not to jeopardize the one voice model. To this end, NSLAG would likely benefit from developing a concise reference tool with its position on recurring issues and most common legal authorities invoked and make the tool accessible to counsel to support their real-time advice.

(U) Not every legal issue will be routine. Yet, counsel participating in operational planning should be well positioned to anticipate and articulate more difficult legal issues, and then be responsible for resolving these legal questions in keeping with Justice’s one voice approach. Counsel involved in operational planning should serve as the entry to Justice for matters requiring additional internal consultation at Justice with either their NSLAG colleagues or those in centres of expertise. A counsel fully apprised of operational realities who is able to “case- manage” the provision of advice in this manner may avoid the problems of “broken telephone” and non-responsive legal advice associated with the conventional advice-giving model.

(U) Legal involvement in CSIS activities, as they are being planned and organized, should also allow Justice to provide informal legal nudges that allow CSIS to course-correct before too much time has been spent. Closer legal involvement during the early phases will minimize the need for legal opinions on operations that are late in the development cycle or that are already underway. Put another way, a more iterative process of incorporating legal advice over the full course of an operation could address the reported challenge of operations halted due to untimely or ambiguous legal advice.

(U) Critically, meeting these objectives requires CSIS to invite Justice counsel to sit at the table at all stages of the lifecycle of an operation, and for Justice counsel to be fully and frankly briefed on operational objectives, intent, and details.

d) Broader Department of Justice

(U) Justice has embarked on a “transformational change” initiative, in consultation with clients, to improve how it conducts its work and supports its clients. Launched in 2018, the VISION comprises four pillars: meaningful risk assessments; client-centric strategic partnerships; recognizing and building expertise; and, simplifying the funding model. One of the key priorities includes an overhaul of the existing Legal Risk Management Framework, which Justice has recognized for some time does not effectively communicate risk.

(U) Interviewees made clear that Justice’s manner of characterizing legal risk in the Legal Risk Management (LRM) Framework is not understood in the same way by its lawyers and its clients and is not always regarded as useful even by the lawyers applying it. For instance, something that is “high legal risk” is very likely unlawful under the LRM Framework, but this was not always understood by clients. Justice did not provide NSIRA with the full draft revised LRM Framework as modified in the context of VISION, as it is still under development. Justice did however provide and brief NSIRA on some working LRM documents. On the basis of these materials and briefings, NSIRA believes that two [aspects relating to the LRM Framework] need to be addressed.

(U) First, there will be instances in giving advice where Justice should describe activity not as “high risk”, but simply as unlawful. Certain legal questions can be answered unequivocally, even accounting for the cautious nature of lawyerly advice. In a system based on the rule of law, and given the role of the Attorney General, such questions should be answered in as definitive a manner as possible. That there may be some hypothetical possibility that the activity might not be unlawful does not mean that Justice should fall back only on the language of “high risk”, since this phrase may give a client the impression such activities, while “risky”, are still a viable option for risk-embracing officials. Justice should avoid such situations. Where an activity is very likely unlawful, Justice should tell the client exactly that and describe the consequences of proceeding, rather than simply couch its conclusions in a probabilistic formula.

(S/C) Some interviewees underscored this view in discussions with NSIRA. Further, NSIRA notes that Justice has proposed [discussion of Justice initative]

(S/C) [Discussion of operational aspects and purpose of Justice initative]

(U) In contrast [discussion of an NSIRA perceived gap in Justice initative]. In NSIRA’s view, this approach is [Discussion of NSIRA’s recommended approach to address the identified gap]

(U) Second, NSIRA notes that many of the [description of certain aspects of Justice’s tools] NSIRA regards these considerations as inappropriate,

(U) Justice believes that the draft [discussion of aspects of Justice initative]

(U) Still, without careful mitigation, NSIRA believes that there remains a risk [discussion of a concern relating to Justice initative]

(U) In sum, based on the role of the AG in advancing the rule of law, [discussion of a standard to address the identified concern in the Justice initative] In future reviews implicating Justice’s legal advice, NSIRA will be attentive to whether advice meets this standard.

Finding no. 1: NSIRA finds that the legal advice-seeking and giving process, and resource constraints at NSLAG, contribute to considerable delays, [description of timeline]

Finding no. 2: NSIRA finds that Justice legal opinions have sometimes been prepared without sufficient attention to the audience that needs to understand and act on them. Opinions have been focused on assessing legal risk, often late in the development of a CSIS activity, with limited effort made to propose alternative and legally sustainable means of arriving at the intended objective.

Finding no. 3: NSIRA finds that the Justice Legal Risk Management Framework is misunderstood at the working level at CSIS and that it does not provide an appropriate framework for the unequivocal communication of unlawful conduct to CSIS.

Finding no. 4: NSIRA finds that difficulties in acquiring prompt and relevant legal advice have contributed to the [discussion of the detrimental effects on and risks to operations] that may require legal advice. In consequence, the manner in which Justice has provided legal advice to CSIS does not always meet the needs of CSIS operations.

Finding 5: NSIRA finds that Justice does not generate the necessary business analytics to track its service delivery performance to CSIS.

Finding no. 6: NSIRA finds that Justice has acknowledged that internal silos at NSLAG between the advisory and litigation wings have sometimes left warrant counsel unaware of emerging legal issues and that Justice has taken steps to resolve these issues.

Finding no. 7: NSIRA finds that Justice has committed to improve its advice giving to CSIS, including moving toward “road map” style legal advice that involves working collaboratively and iteratively with CSIS to achieve operational goals within the bounds of the law.

Finding no. 8: NSIRA finds that CSIS has not always shared all relevant information with NSLAG, prompting a degree of mistrust and limiting Justice’s ability to provide responsive legal advice.

In view of these findings, NSIRA recommends that:

(U) Recommendation no. 1: Justice pursue its commitment to reforming the manner of providing legal advice to CSIS, and its stated commitment to “road- map” style advice as a best practice. In support of this objective and the provision of timely, operationally relevant advice, NSIRA further recommends that Justice implement the following:

  • Whether through an expanded office hours or liaison counsel program or otherwise, NSLAG must develop a legal support service operating full time, staffed by experienced lawyers empowered to provide operational advice in real time on which CSIS officers can rely, on the basis of settled Justice positions on recurring legal issues, accessible directly to CSIS officers across all regional offices and at all levels.
  • NSLAG develop a concise reference tool with its position on recurring issues and most common legal authorities invoked and make the tool accessible to counsel to support their real-time advice.
  • To minimize the need to resort to the formalized legal advice-seeking process, NSLAG (in coordination with CSIS) must involve counsel with CSIS officers at the early stage of the planning of key or novel operations and throughout their entire operational lifecycle to case manage an iterative legal guidance process.

(U) Recommendation no. 2: NSLAG (in coordination with CSIS) develop Key Performance Indicators to measure the delivery of legal services to CSIS.

(U) Recommendation no. 3: CSIS and Justice include in their training programs interactive scenario-based training developing the operational intelligence activities expertise of NSLAG counsel and the legal knowledge of CSIS operational staff.

(U) Recommendation no. 4: To ensure Justice is able to give meaningful and responsive legal advice as recommended in recommendation #1, that CSIS invite Justice counsel to sit at the table at all stages of the lifecycle of key and novel operations, and that it fully and frankly brief counsel on operational objectives, intent, and details.

(U) Recommendation no. 5: Justice’s advice giving must clearly and unequivocally communicate advice on the unlawfulness of client conduct, whether criminal or otherwise.

B. Warrant Process

(U) While the preceding section dealt with issues related to the provision of legal advice in the course of all of CSIS operations, the current warrant process is fraught with its own problems, as illustrated by numerous Federal Court decisions.

(U) Warrants are critical to CSIS’s success as an intelligence service. [Discussion of prior internal review]“The information obtained through their execution is the Service’s lifeblood”. At the same time, another, more recent review concluded that for many within CSIS, the warrant process is regarded as a “necessary evil” on account of its onerousness. This section examines the “warrants life cycle”, from prioritization to execution, in order to identify and assess the underlying factors that have made CSIS’s warrant process cumbersome.

(U) Section 21 of the CSIS Act provides the basic rules for warrant applications. If CSIS believes on reasonable grounds that a warrant is required to enable it to investigate a threat to the security of Canada (or collect foreign intelligence for section.16 purposes), it may, with the approval of the Minister, make an application to the Federal Court for a warrant. The affidavit supporting the application must provide the supporting facts demonstrating the reasonable grounds to believe that a warrant is needed to investigate the threat.

(U) In practice, CSIS organizes the process of seeking a warrant around a system of internal preparation and approvals before proceeding to the statutory step of seeking ministerial approval of the warrant application. In order to understand fully the warrant process, NSIRA has broken it down into several stages of a larger “warrant lifecycle”, each of which are discussed below.

(U) A number of legal concepts and expectations enter into the warrant process, including, in particular, the “duty of candour” owed to the Court. As noted, warrant proceedings are conducted in the absence of the target and are closed to the public in order to protect the covert nature of a search. To compensate, however, for the one-sided nature of such proceedings, courts (and the law societies that regulate the legal profession) impose elevated obligations of candour on the lawyers and party appearing before the court, also known as a duty of utmost good faith. The evidence presented by the party “must be complete and thorough and no relevant information adverse to the interest of the party must be withheld.” In consequence, the party must “conduct a thorough review of the information in its possession and make representations based on all of the information including that which is unfavourable to their case.”

(U) The concept of “materiality” guides which facts must be disclosed to the court. Thus, in CSIS warrant applications, CSIS “must present all material facts, favourable or otherwise”. “Materiality” simply means a fact relevant to an issue in the case. For CSIS warrants, “information is material if it is relevant to the determination a judge must make in deciding whether or not to issue a warrant, and if so, on what terms.” For instance, a material fact is one that is relevant to “the belief, on reasonable grounds, that a warrant… is required to enable” CSIS to investigate a threat to the security of Canada.

(U) The Federal Court has held, however, that materiality extends beyond facts relevant to the factors expressly listed in section 21 of the CSIS Act. For instance, materiality reaches “information about the broader framework in which applications for the issuance of CSIS Act warrants are brought”. This means the duty of candour includes information that is “material to the judicial exercise of discretion” to issue a warrant. It includes the flagging of “legal issues that could be of concern to the Court”. Legal issues do not, however, exhaust this broader category of materiality, as it also reaches disclosure of CSIS’s precise conduct under a warrant that may influence the Court’s exercise of discretion.

(U) This broader category of “material to the exercise of discretion” relates to the especially important role of the Federal Court as the primary source of independent control over CSIS activities conducted under warrant. Unlike a police warrant, which may be retrospectively scrutinized by a second judge in adversarial proceedings if a police investigation culminates in a prosecution, the Federal Court judge is often the only judge who ever examines a CSIS warrant. The target of the warrant or the broader public will usually never know the CSIS activities conducted under the authority of that warrant. In this context, the Federal Court has signaled a redoubled urgency to meeting a broad duty of candour.

(U) It is clear, however, from our interviews, that the broad conception of materiality has led to doubt and confusion within NSLAG and thus within CSIS. Those interviewees who addressed the issue appeared to agree that Federal Court candour concerns now fit into (at minimum) two categories, which we define as “material to credibility”, and “material to matters of potential concern”. NSIRA defines these categories as follows:

  • Material to Credibility: Facts relevant to an express statutory threshold that the court is asked to assess, most notably the statutory standards judges consider in issuing warrants. This category includes, especially, information that goes to the credibility of the sources whose information supports the warrant application.
  • Material to Matters of Potential Concern: Facts or legal issues concerning those aspects of the CSIS activity that might be unusual (or unanticipated) and that a judge will wish to know in exercising their discretion to issue a warrant and in imposing associated conditions. This category includes, for example, a failure to disclose tradecraft conducted to gather information supporting the warrant that may constitute illegal activity, the failure to disclose conduct under a warrant that might result in information sharing with other agencies, potentially imperiling the target, or circumstances in which the warrant will be implemented and that may not be obvious in the application.

(U) The first category of materiality should be well understood by CSIS and its lawyers. The contours of the second category are not as easily determined and require careful consideration by Justice counsel, assisted by a professional cadre of affiants who reach out to regions to determine how warrants will be executed.

2. Historical Initiatives

(U) As outlined in Annex A, incidents concerning CSIS’s observance of its duty of candour are almost as old as CSIS. Following each failure, CSIS Directors promised reforms. CSIS introduced new policies, but problems recurred. In other words, repeatedly, progress has been made on paper, but without genuinely correcting the underlying problems. CSIS appears to have a long history of quick reforms, followed by neglect, high turnover of personnel leading to a loss of institutional knowledge, and resourcing that did not match stated priorities. Some interviewees described reforms as typically focused on the minutiae of process rather than on achieving measurable outcomes. CSIS does not track or measure the success of past reforms. In the eyes of some, CSIS reforms often represented “band-aid” solutions rather than attempts to get to the core of issues, and often resulted in the creation of new bureaucracy. In NSIRA’s view, CSIS’s chief challenge is to break this cycle.

Finding no. 9: NSIRA finds that CSIS has a history of quick reforms, followed by neglect, high turnover of personnel leading to a loss of institutional knowledge, and resourcing that did not match stated priorities. CSIS does not track or measure the outcome of past reforms adequately and has no performance metrics for assessing success.

3. Description of the Warrant Process

(U) NSIRA notes that even determining how the warrants process works presents Internally, warrant requirements are not adequately codified in applicable policy. CSIS policies have not kept pace with operational reality, as they are often vague, dated, overlapping and contradictory. The gap in policy was evident when examining the warrants policies, which were last updated in 2018 prior to the warrant process undergoing substantial changes, including the implementation of the Affiant Unit (AU) in 2019. Given these issues, a basic question that arises is whether those CSIS officers conducting investigations are sufficiently attuned to when the law requires a warrant.

(U) NSIRA heard that there is a clear threshold for when a warrant process must typically be initiated for well-established collection techniques. However, absent clear policy, there was more legal doubt when at issue was the use of novel technologies with uncertain legal ramifications and requirements.

a) Prioritization of Investigations for Warrants

(U) Once a region or desk has identified the need for a warrant, the first step in the process is the internal prioritization at CSIS of a target case file or investigation for a warrant application. In practice, this prioritization amounts to a system of triage, assigning limited warrant application resources to specific files. However, it was evident to NSIRA that CSIS employees involved in the warrants process had little to no common understanding regarding the process or basis on which a warrant is prioritized. Even senior officials in the CSIS hierarchy regarded the prioritization process as a mystery.

(U) NSIRA heard that headquarters prioritization standards remain a work in progress, and sometimes a struggle among competing interests. The DDO meets weekly with a number of CSIS executives to discuss the investigations requesting a warrant and the possible operational, legal or process developments that could affect priorities for decision-making on warrants prioritization.  While NSIRA was informed that there is a record of decision produced after each prioritization meeting, it remains unclear what criteria are used to prioritize a warrant. Some information suggested prioritization has focused on security-related issues. Others speculated that prioritization also considered the perceived amount of work, availability of lawyers and affiants, and how long it would be until current warrant powers expired and needed renewal. Frequent shifts in this process of prioritization have reportedly produced situations where a warrant process starts and stops several times, wasting precious time and adding to operational uncertainty.

(U) Given the complexity and lack of clarity of the prioritization process, it has been very difficult to bring novel issues to the Court with the goal of addressing legal ambiguities through court decisions. NSIRA heard about activities that [discussion of detrimental effects on operations] over unresolved questions of law that could have been addressed by the Court. There appeared to be agreement among our interviewees that more matters should be taken to court – and whenever in doubt, seek a warrant.

(U) Given the current situation, however, NSIRA’s impression is that for CSIS to take a legal issue to Court likely requires the combination of a high priority investigation and the existence of just the right real-world scenario to illustrate the legal issue. Of course, any attempt to resolve legal uncertainty runs the risk of obtaining a legal ruling that constrains rather than empowers investigations. NSIRA heard from some interviewees that there may be a reluctance to take issues to court as there is always a risk of obtaining the “wrong answer”.

Finding no. 10: NSIRA finds that CSIS policies have not kept pace with operational reality, as they are often vague, dated, overlapping and contradictory. The absence of clear policy creates legal doubt or concerns, and gives rise to disparate interpretations of legal and operational standards.

Finding no. 11: NSIRA finds that there is little common understanding regarding the process or basis on which a warrant is prioritized. Frequent shifts in this process of prioritization have added to operational uncertainty. The prioritization process has made it very difficult to bring novel issues to the Court with the goal of addressing legal ambiguities through court decisions.

Recommendation no. 6: NSIRA recommends that CSIS adopt, and share internally, clear criteria for the warrant prioritization process.

b) The Complexity of the Warrant Acquisition Process

(S/C) Once CSIS decides to prioritize a warrant application for an investigation/case, CSIS begins the warrant acquisition process. This process has always been lengthy and bureaucratic. In 1992, the Honourable George Addy reviewed the CSIS warrant process and reported [number] steps spanning a total of [number] and involving from [number] people. Approximately [number] people knew the identity of the target before the warrant was issued, seemingly undercutting the “need to know” principle. George Addy commented adversely on the length of the warrant process. He wrote: “[w]hatever procedures might finally be decided upon, it is of paramount importance that, from the moment the decision to initiate the process is taken, the time required to obtain a warrant should never exceed [timeline], as an absolute maximum.”

(S/C) Yet, [discussion of prior internal review]

(S) At present, according to the documents provided to NSIRA, the process involves [Number] administrative steps in a security intelligence warrant request, [Number] which are internal to CSIS and Justice prior to the application’s filing at the Federal Court. For a foreign intelligence warrant, there [Number] steps. The timetable for the renewal of a security intelligence warrant anticipates a process of [Number] working days, or [timeline] (Annex B). The process involves  committees or units within CSIS (and possibly more if the warrant implicates more than one region), NSLAG, and Public Safety Canada. At least [Number] CSIS managers are named in the process, as are [Number] Justice employees and the Minister and Deputy Minister of Public Safety.

(U) NSIRA was unable to find any one person who could describe precisely the rationale of each of these [multiple] of steps in the overarching scheme; even those close to the process were not always sure what role each approval step played. Few of the steps are mandated by law, but rather they appear to have accrued over time despite repeated efforts at streamlining. Some steps appear to reflect older reform efforts triggered by concerns over compliance, not least with the duty of candour. And yet, as noted at the outset of this review, the candour issues at CSIS persist.

(U) In sum, the warrant process appears to be caught in a vicious cycle whereby duty of candour failures (or the fear of prospective failures) cause CSIS to add more bureaucratic fixes, which complicate an already lengthy and inefficient process without actually resolving the underlying issues that led to the duty of candour failures in the first place. Indeed, as discussed below, the complexity of the warrant process appears itself to contribute to CSIS’s candour issues. CSIS and Justice must break this cycle. A description of how best to do this will first require further discussion of the warrant process itself.

c) The Key Steps in the Process

(U) CSIS maintains five categories of warrant applications, the most common of which are new warrants, replacement of existing warrants159, and supplemental warrants. Each category has its initiating procedures.160 In all applications, the relevant desk at headquarters and the implicated CSIS operational region conducting the investigation prepare a [content of document]. Together, the [number] documents detail the threat, the targets, and set out the investigative powers CSIS proposes to use. Once approved, CSIS sends the [document] to NSLAG for a “threshold” determination; i.e., an assessment of whether there are reasonable grounds to believe that a warrant is required to investigate the threat. If NSLAG concludes that the proposed targets meet the threshold, then development of the rest of the warrant application begins. The key contributors to this process are the Affiant Unit, NSLAG and the Warrant Administration Unit.

(U) The Affiant Unit (with the advice and legal support of NSLAG) is responsible for preparing the affidavit used in support of the warrant application. The affidavit is the affiant’s sworn written testimony and includes a range of information required pursuant to section 21 of the CSIS Act. The affidavit is often laid out as follows.

  • Part 1 – Introduction: this section outlines the affiant’s work experience and introduces the sources of information and the exhibits used in the application.
  • Part 2 – The threat: this section provides information regarding the broader threat and how it relates to CSIS’s investigation and the specific list of target(s).
  • Part 3 – The subjects of the investigation: this section includes a thorough explanation of the threat posed by each target, based on information from human sources and other operational reporting.
  • Part 4 – Powers sought: this section describes the non-warranted (that is pre- or without the need for a warrant) investigative techniques used in the investigation thus far, as well as the powers requested in the application.
  • Part 5 – Other matters: this section includes the duration for which the warrant is sought as well as the required consultation with the Deputy Minister and Minister as per subsections 7(2) and 21(1) of the CSIS Act.

(S) The affidavit will also include a number of exhibits, the most important of which are the human source précis and the foreign agency précis. The human source précis is a summary of information from CSIS’s files that allows the court to assess the reliability and credibility of the human source without revealing the source’s identity. It comprises information pertaining to the source’s relationship with CSIS, [description of information] and motivation. The précis will also include a corroboration table used to support the source information contained in the affidavit. Where the application relies on information supplied by a foreign agency, the foreign agency précis includes background information regarding the mandate of that agency, the agency’s history with CSIS, and whether the information relied upon in the application may have been obtained as a result of mistreatment.

(U) Once approved and reviewed in keeping with several additional steps, including the Independent Counsel vetting discussed below, the application goes before the Warrant Review Committee (WRC) for approval. The committee comprises senior members of CSIS and the department of Public Safety Canada as well as observers from other government agencies such as CSE and the RCMP. At the WRC, the affiant provides a brief overview of the investigation, the application is discussed, and a decision is made regarding whether to proceed with the application, and if so, what changes are required. The application is then submitted to Public Safety Canada, where it is reviewed and passed to the Minister accompanied by a summary and advice as to whether the Minister should approve the application. Once approved, Justice files the warrant application package in court on behalf of CSIS.

4. Observations on the Warrant Process

a) A Lengthy, Bureaucratic Process

(U) The complexity of the CSIS warrant acquisition process is quite unlike the manner in which the police obtain their search warrants. The length of the process itself can pose operational risks, [it may affect the warrant].

(U) There are reasons why CSIS warrants are more administratively burdensome. Unlike police investigations, CSIS investigations rarely produce evidence culminating in criminal proceedings in court. They thus lack the prospect of retrospective challenge by a party with a vested interest in testing the propriety of the warrant. The safeguards in the CSIS warrant context are therefore prospective, and properly include a careful bureaucratic vetting, as well as executive control exercised by the Minister of Public Safety and judicial control by the Federal Certain steps, such as the Warrant Review Committee, discussed further below, are therefore desirable. However, beyond a certain point, more steps does not correlate with better quality. Indeed, NSIRA observed that many of the steps in the warrant process amount to a series of minor tweaks and clerical changes of limited importance to an application that often becomes an exercise in ‘drafting by committee’. What the proliferation of steps has done, however, is to create a process widely regarded as slow and unwieldy, with no clear lines of accountability.

(U) For many of our interviewees, the process had the following features:

  • Lack of clear accountability due to the proliferation of approvals: Some interviewees described the multiplicity of approvals as a symptom of a broader CSIS culture in which responsibility is diffused, ensuring that the locus of responsibility is never clear. Put more strongly, some interviewees saw the proliferation of approvals as reflective of a risk-averse culture in which officials employ a ‘safety in numbers’ approach to decisions and sign-offs. In this model, no individual is personally accountable; rather, accountability is diffused throughout the institution. Senior management disputed this characterization noting their support for the concept of shared accountability through approvals. Even so, there did not appear to be disagreement that accountability could be better defined.
  • Privileging sign-offs over substance: The long list of approvals over the course of the warrant process consume time; each level of approval means a pause in the work, meaning that the time available to do the substantive work of preparing the warrant application is often squeezed. Since it is not always clear what function each step performs, it is difficult to disaggregate substantive steps from various forms of managerial review, approval and vetting. However, by NSIRA’s estimate, only [timeline] associated with a warrant (renewal) application involve core substantive work. Many interviewees across varying levels favoured prioritizing time spent on preparation over that spent on managerial approvals. Although recent attempts to streamline the process have resulted in several steps being conducted concurrently, there is little indication that the time saved was reallocated to the preparation of the most complex portions of the application, such as the human source précis.
  • A process of black boxes: The warrant process involves a large number of people. Officials implicated at each stage often seemed unfamiliar with decisions made at other stages or the rationales for these decisions. Put another way, each official understood their piece of the puzzle, but had little sense of how the various pieces fit together. There appeared to be few (if any) regular feedback loops, in which explanations for decisions made at one level filtered back to other levels. This tendency to keep information ‘siloed’ meant that many employees felt that their knowledge of the warrant process was not as good as it should have been and wanted greater visibility on the process as a whole.
  • Lack of regional involvement: The ‘silo’ or ‘black box’ approach is most galling to the regional investigators. Even though the warrant requests originate from the regions and are made to support regional investigations, operational officials in the regions often have a very limited role in the warrant process. Some requests move forward and others do not, but it is not clear why. When warrants come up for renewal, NSIRA was told that headquarters has not typically sought input from the regions on new collection techniques, and that regions have struggled to obtain modifications in subsequent iterations of warrants to ensure that the warrant reflects operational needs. Interviewees regularly advanced the argument for feedback to and closer engagement with the regions (including on technical matters) throughout the warrant application. The region is best placed to flag issues of concern with the investigation and the sources involved, issues that could be important to the Court. To this end, NSIRA notes that the affidavit and source précis should be regularly shared with the source handler in the region. Likewise, the region should be consulted throughout the warrant application process, and should be represented at the Warrant Review Committee.
  • Excessive warrant scope and scale: One matter of concern was the sheer length of some of the affidavits CSIS has put forward in support of warrant applications. This was most pronounced in [type] warrants where requests are made in support of multiple investigations under one application. A related issue is CSIS’s tendency to include requests for a wide range of investigative techniques, regardless of whether there was an actual plan to employ them. This appears to be done on the theory that it was prudent to seek all possible powers rather than risk needing to return to court later on – particularly given the amount of time that such a process would involve. An alternative approach is more targeted and streamlined warrant applications, done in greater number and on a predictable annual schedule. This reform was repeatedly favoured in our interviews. Of course, this approach will only succeed if a higher number of warrant applications does not produce more warrant applications of the same length and complexity of the [type] warrants. If the administrative burden of approvals associated with the present system is applied to more warrants, it seems unlikely the system will work. That is, this reform may only succeed by relaxing what was described to us as a “one size fits all” approach to warrant applications, with length and complexity unconnected to the scale or degree of intrusiveness of the techniques at issue.

(U) NSIRA is therefore of the view that there are significant changes that CSIS could make that would materially improve the quality of warrant applications. NSIRA does not think that the bureaucratization of the CSIS warrant process as described above has improved matters; on the contrary, the lack of clear accountability, lack of internal communication, and excessive complexity have all contributed to the problems facing the process. NSIRA agrees fully with the view that time should be reallocated to those stages that make for a better warrant, including regular engagement with the regions.

(U) The warrant process should not be mired in steps that amount to the shuffling of paper between desks. These should either be eliminated, or conducted concurrently with more substantively meaningful steps, avoiding the reality or perception of pro forma involvement by officials who lack a clear and manifest need for involvement in the warrants process. Put another way, where there are steps that do not make a significant contribution to a more accurate application, CSIS should eliminate them.

Finding no.12: NSIRA finds that the actors involved in the warrant process do not have a common understanding of the rationale for each of the [multiple] steps in the overarching warrant application scheme and are not always sure what role each approval step plays.

Finding no. 13: NSIRA finds that the proliferation of process in seeking warrants has created a system of diluted accountability widely regarded as slow and unwieldy, with delays caused by multiple levels of approval.

Finding 14: NSIRA finds there is no regular feedback process in which explanations for warrant-related decisions made at one level filter back to other levels. The absence of feedback is especially acute for the regional investigators.

Finding 15: NSIRA finds that often, the sole means to address legal uncertainty is to bring legal questions to the Federal Court through warrant applications. In consequence, an unwieldy warrant process makes resolution of legal doubt more difficult.

In view of these findings, with respect to the warrant process, NSIRA recommends that:

Recommendation no. 7: CSIS establish a new warrant process eliminating steps that do not make a significant contribution to a more accurate application. The process should assign clear lines of responsibility for the production of accurate applications. The reformed system should ensure that delays associated with managerial approvals are minimized, and that time is reallocated to those steps contributing to the preparation of the accurate applications.

Recommendation no. 8: CSIS integrate the regional stakeholders (including the implicated investigators) at every key milestone of the warrants process.

Recommendation no. 9: CSIS adopt policies and procedures governing the reformed warrant process that clearly outlines the roles and responsibilities of each participant and the objective of each step in the warrant process and that these policies be kept current as the process evolves.

b) Incomplete Knowledge Management in the Regions

(U) When discussing the warrant process, NSIRA often asked who should be responsible for the accuracy and completeness of the warrant application. There are two clear points of responsibility. First, staff in the regional offices conducting investigations are responsible for feeding complete, correct and appropriately contextualized information into the warrant production process. Second, the individual most responsible for the final product is the affiant, whose sworn affidavit supports the warrant application and supplies the factual basis permitting the Court to conclude that the legal requirements for the issuance of a warrant have been met. After all, if there is to be a duty of candour failure, it will be because of an inadequate affidavit. Meeting these obligations is, however, unnecessarily difficult for both the regions and the affiant, for the reasons below.

(U) CSIS warrant applications often depend on information collected from confidential human sources. As discussed above, the reliability of this information – and the credibility of the source – constitute key material facts in warrant applications. A failure to apprise the court of information relating to credibility is a clear violation of the duty of candour.

(U) As noted, source information appears in the warrant application through the source précis and affidavit. The source précis and affidavit, in turn, stem from information that was originally collected by the regions, which handle human sources. In practice, therefore, the affidavit is no better than the quality of the information provided by the regions. If that information is incomplete, none of the [multiple] steps in the CSIS warrant acquisition process can compensate. Notably, omissions regarding human sources have occurred repeatedly in the past. This report calls this the “recurring omissions” problem.

i. Misunderstanding Concepts

(U) NSIRA detected several factors that heighten the risk that regions will omit information material to the warrant application. Indeed, some duty of candour breaches seem to be explained by these factors.

(U) NSIRA was told that police learn how to piece together a narrative that “shows their work”, and police informant handlers also are generally familiar with credibility and candour issues. CSIS is not culturally attuned to this same standard, despite the importance of the legal expectations it must meet. Indeed, CSIS officers, when writing intelligence reports, are trained to dissociate the substance of the intelligence from its provenance, in order to allow the resulting reporting to be disseminated to clients in government without permitting readers to infer the identity of sources.

(U) Indeed, there seems to be a disconnect between CSIS’s traditional understanding of reliability for intelligence purposes, and the broader concept of credibility for legal purposes. Intelligence reliability is based on the source’s track record as corroborated by other sources of information. Credibility, however, may depend on more information about the sources themselves, including their personal conduct and disposition. CSIS source handlers may, however, be inclined culturally to invest [ description of relationship between source handler and source ].  Moreover, NSIRA heard repeatedly that CSIS officers involved in the early stages of warrant preparation do not clearly understand the legal expectations associated with the duty of candour.

(U) For these reasons, it has sometimes not occurred to these officers that conduct exhibited by the source –   [example of source conduct]  – may constitute material information important to a court in assessing the credibility of that source. CSIS may have long ago noted these issues, but nonetheless concluded that the source’s reporting was generally accurate. Thereafter, officers may not realize that it is vital to put all such context before the Court. Officers may also misunderstand the implications of source shortcomings for the Court, fearing that their sources’ information will be discounted because of personal shortcomings. In fact, the Court has understood that a source’s moral shortcomings alone do not mean that the source cannot be believed; judges do not assume that sources in national security investigations will always be upstanding citizens, any more than they do in police organized crime investigations. This was recently reiterated by the Court, noting that “the fact that human sources live what some would consider unsavoury lives is something to be expected when assessing human source information provided in the context of a CSIS Act warrant application”.

(S) Under the current CSIS procedure on Human Source [name of procedure] every CSIS human source is assigned a a brief and standardized description of [Discussion of human source issues, including reliability and credibility]

(U) The role of a judge in issuing a warrant is different. The judge must independently conclude that the information before them is reliable. In conducting this independent assessment, the judge must have all of the information they need to be satisfied that the source of the information is reliable and credible, even if CSIS believes that the information is accurate. The Federal Court recently noted that:
“Judges of this Court expect a Human Source Précis to bring to their attention all information known to the Service that might be relevant to the Court’s assessment of the credibility or reliability of a human source. The Service must provide the Federal Court with a relevant and full picture concerning the credibility and reliability of a human source. This Human Source Précis must be relevant, full and complete if the Service is to comply with the duty of candour. The Service employee must not pull punches, conceal information, or convey half-truths, nor may he or she bring false or misleading information to the Court.”

(U) To this end, CSIS’s own assessment of a source’s reliability may be relevant but it is not for the Court to take it on faith. The best analogy presented to NSIRA was this: the affidavit must “show CSIS’s work” just as a math student shows the full calculation in computing an answer through long division. That is, the affidavit must contain the full range of considerations relevant to a source’s credibility, and then explain why CSIS considers the source’s information reliable. The judge can then make their own assessment, and not simply depend on CSIS’s pre-existing conclusion. Asserting that conclusion without “showing the work” and articulating the range of considerations tied to credibility amounts to a failure to be candid, particularly when CSIS has concluded that a source is reliable despite certain factors that, on their own, could give rise to doubts about the source’s credibility. NSIRA believes this analogy to be a helpful one so long as “showing CSIS’s work” includes the full range of information material to the issuance of the warrant, a point to which we return below.

(U) In summary, to avoid “recurring omissions” before the Court, CSIS must internalize a clearer understanding of the Court’s This is particularly crucial amongst those involved in the preparation of warrants, including source handlers compiling the initial information.

ii. Information Management Struggles

(S) Even if CSIS officers were fully conscious of the scope of the concept of candour to the Court, the way in which CSIS manages its information would likely still give rise to recurring omissions. In its interviews, NSIRA heard that CSIS’s management of information related to human sources creates problems. [Discussion of IM issues]

(S) Information is often situated in the (changing and variable) institutional memory of source handlers. [Discussion of IM issues] Any institutional knowledge not archived properly is lost, as Intelligence Officers (IOs) are rotated regularly under CSIS’s human resources model.

(S) Since source-related information [discussion of IM issues] the review process can be laborious. When connected to the first factor noted above – a limited understanding by CSIS officers of legal materiality – mistakes are inevitable. Moreover, as operational reports written by handlers are sent through a hierarchal chain of approval, there is no method of tracking any changes made by supervisors to the handler’s report, making it difficult to identify the origin of a problem should it arise.

iii. Fixing the Recurring Omissions Problem

(U) CSIS and NSLAG are alive to these problems. They have conducted more training on the need for adequate documentation in order to fulfill the duty of candour obligations to the Court. Justice counsel have more access now than in the past to source materials. Indeed, in the short term, in some cases, they have responded to the recurring omissions problem by involving warrant counsel directly in the review of source files. Counsel auditing of source files is, however, resource intensive and arguably displaces a responsibility for source information preparation that properly lies with CSIS itself. It is the affiant, working with the regions, who should guarantee and be answerable for the accuracy of the source information, not counsel.

(S) More generally, CSIS should ensure that source handlers are assiduous in documenting information going to credibility, no matter how seemingly unimportant. The lack of adequate documentation was a key finding in the Rosenberg report, an independent review commissioned following a breach of the duty of candour to the court. In response to it, CSIS set up Project [Name]. Its main objective was to encourage better documentation of the full picture of intelligence and operational activity with the goal of improving operational effectiveness. One identified quick win now associated with [Name] was the regional roll out of [discussion of an information gathering tool] NSIRA was advised that this approach is being prioritized for sources whose information supports active warrants.

(S) NSIRA heard, however, that completing [information gathering tool] is a considerable task, requiring a comprehensive and thorough review [requirements of the information gathering tool]. Furthermore, NSIRA heard there is a certain level of frustration by source handlers at the implementation of this stand-alone requirement rather than building on preexisting [category of] documents, [examples of preexisting documents]

(S) Indeed, CSIS acknowledges that it designed [information gathering tool] to be a temporary tool to address and mitigate the larger recurring omissions problem. One of the long-term goals of Project [Name] is to develop a system [objectives of the system] It is unclear if this system will be stand-alone, integrated into preexisting systems, or developed as part of a planned [Name] , designed to consolidate all the administrative processes and workflows required to manage a case and document its progression. The [Name] is due to be partially implemented [timeline] while the proposed [Name] human source information system appeared to be aspirational and only at the early stages of identifying a possible solution. This is unfortunate, as the [info.tool] represents a “band-aid” solution to issues that, in the long run, would be better addressed by deeper improvements to the management of human source information.

(S) Even setting aside longer-term considerations, a [info. gathering tool] process is not a panacea. For one thing, the [info. gathering tool] is only as good as the person completing it. Until recently, there was no formal [info. tool] training for source handlers. More than a year after it was implemented, CSIS’s Learning and Development Branch was unaware of the [info gathering] tool. Furthermore, it should be possible to audit the responses provided in the [info. gathering tool] In the past, prior to the creation of the Affiant Unit (AU), the facting was formally reviewed by the [name of branch and positions conducting review]. Only [postion] had access to the full range of human source information, however, as verification was considered a “side of desk” task. Now, the AU has access to the human source files and NSIRA was told it reviews the original documents referenced in the [info. gathering tool] as well as running queries through human source and operational databases and consulting with the source handler. To do this properly, however, the AU itself will need to be resourced and encouraged to audit the information prepared by the regions. This report discusses the question of the AU’s sustainability below.

(U) Finally, several of the interviewees noted that the reformed process is revealing a number of “legacy problems” with CSIS human sources; that is to say, additional duty of candour issues are coming to light as a result of CSIS’s more stringent review of human source files when preparing for warrants. This is indeed a regrettable consequence of CSIS’s former lax practices. For the next few years, therefore, the Federal Court can expect to receive further duty of candour submissions. For its part, NSIRA will need to distinguish between those duty of candour issues rooted in past practices and those that have emerged despite the recent changes.

Finding no. 16: NSIRA finds that CSIS has struggled to ensure that all information material to the credibility of sources is properly contained in warrant applications. This “recurring omissions” problem stems from a misunderstanding of the Federal Court’s role in assessing the credibility of sources and from the presence of multiple, siloed information management systems. CSIS has undertaken reforms, but work remains to implement long-term sustainable solutions.

Recommendation no. 10: To address the seeming inevitability of “recurring omissions”, NSIRA recommends that CSIS prioritize the development of [ an improved ] system for human source information management. CSIS should also continue initiatives meant to ensure that source handlers are assiduous in documenting and then reporting in source précis information going to credibility. Even with these reforms, the Affiant Unit should adopt procedures for verifying the information prepared by the regions.

c) The Affiant Unit

(U) As noted above, the individual most responsible for the final product is the affiant, whose sworn affidavit supports the warrant application and supplies the factual basis for concluding the legal requirements for the issuance of a warrant have been met. Yet while NSIRA’s interlocutors agreed that affiants are ultimately responsible for the affidavit, NSIRA notes that they have not been given a status and authority commensurate with this obligation.

i. The Traditional Approach

(U) Pre-2019, CSIS recruited affiants in security intelligence investigations on an ad hoc basis in support of a particular warrant application. There was no such thing as a professional affiant. The result was considerable unevenness in the caliber and skill-set of affiants. The employees assigned as affiants were, NSIRA was told, sometimes not the best possible candidate, but rather a person with down-time, surplus to immediate operational needs, and not necessarily experienced in the affidavit process. The seeming casualness of affiant selection surprised NSIRA; the affiant is effectively CSIS’s spokesperson to the Federal Court, which alone can authorize invasive investigative techniques. Ensuring a roster of excellent affiants should have been regarded as “mission critical” to CSIS.

ii. The Current Approach

(U) In 2017, in response to the Segal report recommendations (see Annex A), the Affidavit Working Group (AWG) at CSIS recommended the creation of an Affiant Unit of “experienced Intelligence Officers who would be dedicated full-time to the role of representing the Service in court”. The objective of this new unit was the creation of an actual centre of affiant expertiseThe AWG recommended that affiants be employed at Level 10 (typically a senior manager) in the CSIS employment hierarchy “indicating the seniority and importance vested in the role”, with ongoing training and professional development being key components to the unit’s success. The AWG also proposed a process and structure for the development of the unit.

.(U) CSIS ultimately created the Affiant Unit (AU) in 2019, after an order from the Director and during the Federal Court 2020 FC 616 matter.230 NSIRA was repeatedly told that the resources allocated to the unit were based on estimates by the project management team in 2019. The CSIS “End of Project Summary – Establishment of the Affiant Unit” identified the need for an AU structure that included [number] “ Affiants” in order to accommodate past averages of [number] section 12 warrant applications annually. For reasons that are not clear, the final approved structure cut the number of affiants in half, to [number]  The final structure therefore comprised [description of internal structure]. The mandate of the AU was later expanded to include warrant applications for section 16 investigations by adding [number] although this affiant is managed out of the [Name] Unit and the Affiant Unit. This report discuss the implications of how the AU has been staffed below.

iii. The Advantages of an Affiant Unit

(U) Professionalizing affiant work involves trade-offs. For instance, dedicated affiants are better placed to develop and implement consistent processes and standards regarding warrant preparation, but will often have less mastery of the operational details than an affiant chosen from an operational desk, thereby obliging the affiant to spend considerable time familiarizing themselves with the details of each application. Still, our interviewees were consistently of the view that despite the trade-offs, the dedicated affiants and the AU itself represented a significant improvement over the prior ad hoc approach, and noted that the new dedicated affiants have been well received by the Court. Indeed, NSIRA is of the view that a well-staffed AU should constitute a body of expertise on warrant preparation within Robust vetting by the AU could also replace many of the seemingly pro forma steps in the current warrant process that contribute little of substance.

(U) Justice counsel reported having effective working relationships with the affiants, whom they considered to be knowledgeable and professional. For reasons discussed below, however, some counsel were concerned that the affiants were at risk of burn out, and raised concerns regarding the sustainability of the AU.

(U) With regard to the regions, we heard that some affiants, on their own initiative, regularly communicate with regional partners, potentially creating links that could forestall future duty of candour problems. Indeed, NSIRA heard that investigators and their managers welcomed the AU as the path to obtaining warrants. NSIRA was told that AU/regions communication should be a standard practice given the current communication silos existing between headquarters and the regional units responsible for executing warrants. NSIRA agrees that affiants should consistently consult with the regions to understand how the proposed warrants will be executed and to understand generally what is working and what is not. NSIRA notes that experienced affiants could serve as critical sources of institutional knowledge while field officers in the region cycle in and out. Moreover, this interaction between affiant and regions should help counsel anticipate any possible candour matters that could arise were the Court not apprised of potentially controversial means of executing warrant powers.

iv. Challenges to Affiant Unit Sustainability

(U) As explored above, CSIS’s establishment of the AU is a critical development. It is thus all the more concerning that the AU’s sustainability is in question, and indeed NSIRA heard that the unit could currently be described as in a state of crisis. CSIS has not supported the unit with resources commensurate with the importance of this unit in fulfilling CSIS’s mission. Indeed, there may now be less support to affiants operating from the AU than existed under the prior regime of ad hoc affiants supported by other units in CSIS.

(S) The AU faces several overlapping challenges. Over the course of NSIRA’s review, AU staffing was in considerable flux, with personnel cycling through affiant, analyst and management posts. Indeed, by summer 2021, the key role of analysts – usually charged with compiling material from the region and the initial drafting of the affidavit and human source précis – was filled by  [number]  temporary analyst. Of the [number] new affiants hired by the AU during our review, [number] had left by the end of it. Meanwhile, the remaining affiants were cycling through a vacancy as [position] (of the AU). In the result, it would appear there were only [number] people able to act as affiants for and [type of warrant] summer 2021.

(U) NSIRA heard that joining the AU is an unattractive career choice, because CSIS’s human resources policies do not support the stated objective of professionalizing the warrant process. Affiants, much like many at CSIS who are not Intelligence Officers, do not gain the operational experience that is traditionally tied to status and advancement.

(U) At the time of writing, the AU was relying on “surge capacity” by drafting analysts available temporarily from other units of  NSIRA heard that these temporary analysts lack warrant experience. They thus need to be trained by the affiants, only to depart and be replaced. This has added to the burden on affiants, some of whom now complete the drafting process once led by analysts. This also contributes to the workload of NSLAG counsel, who must help fix draft products.

(U) Moreover, the benefits of the AU are currently in jeopardy because of governance and training deficiencies. The AU did not inherit an existing infrastructure or suite of policies and professional standards. The affiants at the time of our review were experienced CSIS officers who often had some prior affiant experience. Those affiants who have been in the AU for a length of time have deepened their expertise through learning on the job. However, none of the affiants or supporting analysts received formal training on their roles. CSIS has not yet put in place a training system to ensure continuity of a standard base of knowledge and skills in the AU. Even if it did, the AU is already under-resourced, fueling turnover, and NSIRA doubts whether the AU has the time and capacity to step back from the day-to-day work in order to build expertise and human capital. For instance, weekly meetings with NSLAG counsel have often been impossible due to time constraints, making it harder for the AU to stay apprised of legal issues.

(S) It is clear that the AU cannot continue to operate in its present manner, and that the risk of burnout for the remaining staff is real. As this review progressed, NSIRA became increasingly concerned that the AU [is in a state of crisis] . The apparent neglect of the AU’s human resources needs is alarming: the AU is not only a key element of CSIS’s response to its recurring candour problems, but it is also operationally vital. Without a functional AU able to produce accurate and compelling warrant applications in a timely manner, [discussion of how CSIS collection activities are affected]

v. Improving and rebuilding

(U) It is clear that the AU needs to be stabilized and expanded by an immediate infusion of new personnel. NSIRA asked how an expanded AU could function, and in response received remarkably consistent responses:

  • “Affiant Teams”: NSIRA heard that each affiant should be supported by [discussion of number of analysts, administrative assistants and paralegals required] –
    forming an expert team. Teams should specialize in counterintelligence or counterterrorism, and should be managed so not everyone leaves as the same time. Likewise, files should be managed so that inexperienced affiants and affiant teams are not paired with inexperienced lawyers.
  • Workload expectations: NSIRA heard that a professional affiant should be able to manage [numbers] affidavits annually, although others emphasized that [numbers] was
    feasible. The lower estimate is closer to CSIS’s own calculation that “given that each application takes approximately [timeline] one affiant could process [number] applications per year.” At this rate, the present roster [number] should be able to generate [number] warrant applications annually. This assumes that affiants are adequately supported, however, which was not the case as of summer 2021. [number] warrants annually would seem inadequate given CSIS’s investigative needs. CSIS will not be able to acquire more warrants without either sacrificing the quality of its applications – and risking new candour problems – or expanding the AU. Moreover, as discussed below, [number] warrants is fewer than the number of warrants that NSLAG is now equipped to support.

(U) Building bigger, skilled and stable affiant teams will require new people willing to join the AU and stay for a reasonable length of time. NSIRA believes achieving this objective requires two sets of reforms: first, changes to career development within the AU; and second, greater institutional commitment.

(U) Without human resources reform and firm prioritization of the AU, NSIRA doubts CSIS will be able to recruit and retain a talented cadre prepared to specialize as affiants and analysts. The ideal affiant, NSIRA was told, was a great analyst and writer, with advanced research skills and robust institutional knowledge about how CSIS operates and how, especially, source information is retained. They must, in addition, be comfortable in court and have an understanding of applicable law. Some affiants have handled sources, while others have not. Source handling experience was not regarded as essential by at least some interviewees, but it was felt that the affiant needed people skills and an ability to manage the affidavit process and relationships with the regions. A successful affiant should have gravitas and an ability to persuade other partners in the warrant process. Moreover, once these people are recruited, like any expert, affiants and analysts need to acquire institutional knowledge – and the AU will need to resist the level of turnover we were told is endemic in CSIS.

(U) NSIRA heard that retaining talent will require attention to several problems. Unlike with at least some police forces, CSIS assigns little prestige to this career path. Indeed, CSIS human resource policies risk orphaning affiants in career limbo, with no natural career progression and advancement path given that time in the Affiant Unit is not time spent gaining front-line operational experience. Specifically, affiants are classified as a “level 9” in the CSIS human resources hierarchy, but only temporarily (if not already level 9). If advanced from level 8 to be an affiant, they return to level 8 if they leave – or must compete for a permanent level 9 elsewhere in CSIS. Despite the considerable pressures on affiants to manage a complicated warrant process and represent CSIS credibly before the Federal Court, affiant work is reportedly not countenanced as meeting prerequisites for promotion into management. Being an affiant is, in other words, not a clear career progression so much as a career diversion.

(U) CSIS has also struggled to resource permanent analysts for the AU. Analysts, much like other non-intelligence officer (non-IO) employees at CSIS, are left with so few career progression options that they often feel like second-class citizens within the the organization.  In order to attract talented analysts, there must be incentives allowing for progression within the non-IO stream, including the AU.

(S) As this discussion underscores, the AU needs more resources, especially in the form of analysts and affiants. However, the AU is left to compete for resources as just another unit under the broad umbrella of the [Name] Branch [Name]. NSIRA heard that the AU’s functions in preparing legally robust warrant applications are not a natural subset of [Name and function of Branch] and that the AU is not well situated in the present structure. This governance anomaly may explain a number of administrative hurdles and human resource and sustainability issues. A new governance structure, with reporting mechanisms consistent with the importance of the function needs to be instituted.

(U) A new Affiant Branch needs to be created and situated in CSIS’s organizational hierarchy reporting directly to the CSIS Director. This would be consistent with the Director’s direct accountability as provided by CSIS Act and signal the AU’s importance to CSIS’s ongoing success and presumably ease the risk of neglect. This change would coincide with the elimination of the often-unnecessary hierarchy of approvals that exist as a result of the AU’s current status as part of [Name] branch. This change may also respond to another observation: that priorities not directly visible to the Director sometimes stall lower in the CSIS hierarchy, and that reform also stalls among managers who do not have a clear incentive to change.

(U) In sum, NSIRA believes that CSIS’s success in overcoming its long-standing difficulties with the warrant process will depend on a robust Affiant Unit. In our future reviews of the warrant process, NSIRA will be attentive to CSIS’s progress in sustaining a robust AU.

Finding no. 17: NSIRA finds that the Affiant Unit (AU) constitutes a vital and laudable reform within CSIS. However, the AU is currently at risk of collapse. CSIS has not supported the unit with resources commensurate with the importance of this unit in fulfilling CSIS’s mission. The benefits of the AU are currently in jeopardy because of governance, human resource, and training deficiencies.

Finding no. 18: NSIRA finds that the Affiant Unit’s placement in the [Name] branch is not commensurate with its functions and importance. This governance anomaly most likely contributes to administrative hurdles and resource challenges faced by the AU.

Finding no. 19: NSIRA finds that without a functional AU able to produce timely and accurate warrant applications, CSIS puts at risk access to warrants and the information collected under them.

In view of the above findings with respect to the AU, NSIRA recommends that:

Recommendation no. 11: CSIS recognize the importance of the Affiant Unit by assigning affiants and analysts an employment classification congruent with their responsibilities.

Recommendation no. 12: CSIS create an Affiant Branch reporting directly to the CSIS Director.

Recommendation no. 13: CSIS urgently resource the Affiant Unit to meet its responsibilities and ensure its sustainability. In deciding the size of the AU, CSIS should assess how many warrants an affiant team might reasonably complete every year.

Recommendation no. 14: CSIS, in consultation with Justice, develop a comprehensive training course for all affiants and analysts, codifying best practices and methods for members of the AU.

d) NSLAG Warrants Counsel

(U) Warrant counsel have several key roles anticipated in the CSIS warrant application process, and are intimately implicated in securing adherence to the duty of candour in warrant applications. As noted, the duty of utmost candour in warrant proceedings is a professional obligation that rules of professional conduct impose on lawyers. Crown counsel in police warrant cases have a redoubled incentive to test warrant applications – no Crown wishes to be the lawyer on a warrant that subsequently fails on ex post facto challenge in a criminal proceeding, jeopardizing a prosecution. While NSLAG counsel face different pressures, duty of candour failures still risk professional reputations, especially given the vigorous displeasure expressed by Federal Court judges in their judgments.

(U) It seems clear that, as a result of 2020 FC 616, NSLAG has weathered a difficult period. Counsel reasonably see themselves as both personally in the cross-hairs of the court’s discontent and dependent on CSIS managing its responsibilities in the warrant process in a way attentive to its legal obligations. From the counsel’s perspective, the process feels like a high risk enterprise, over which hangs a “sword of Damocles”. For its part, as noted, CSIS operational employees may regard Justice as inaccessible and unhelpful. Lawyers vary in their style and manner of operating, with no consistency.

(U) Some lawyers have responded to duty of candour failures by becoming more meticulously involved, in a way described by some CSIS observers as intrusive, micro-managing matters that CSIS feels it should handle. It is apparent that tensions have increased in the last several years between Justice and CSIS, shaped by these perceptions each has of the other. This tension was especially acute, NSIRA was told, at the more senior levels, with some noting that little had improved by the time of our interviews. NSIRA also heard about the need to correct this situation by building mutual trust. This section focuses on the structural sources of those tensions and the prospects of restoring confidence.

(S) First, CSIS interviewees urged that CSIS needed access to more lawyers, sometimes seeing lawyers as the bottleneck in the warrants process. Other interviewees contested this view. These different views may reflect change over time. It is clear that during a recent period, NSLAG had too few available warrant counsel. That situation appears now to be evolving, as new lawyers are recruited by NSLAG. NSIRA agrees, however, with the principle that NSLAG should be staffed to ensure that CSIS’s operations are not stalled due to the non- availability of warrants counsel.

(U) At present, a General Counsel is the strategic lead for warrants and Federal Court matters. In addition, the Senior Counsel warrant coordinator oversees the warrant applications led by NSLAG warrant counsel. The senior counsel warrant coordinator would ideally not manage their own files, and instead would maintain comprehensive visibility on the warrant practice, while assisting and mentoring new warrant counsel. These positions must also bridge the warrant and advisory side of NSLAG, ensuring that emerging legal issues are shared.

(U) The number of actual warrant counsel will affect how many warrants CSIS might seek at the Federal Court. NSIRA asked for views on a metric for determining the ideal number of counsel. Whereas an experienced warrant counsel might once have transacted [number] warrants annually, the scope and scale of applications is now such that the maximum number is [range]. Given this number, and with a roster of  [number] experienced warrant counsel (and several more junior) available by the second half of 2021, the maximum number of warrants NSLAG might support annually may be in the 30-60 range. Notably, this number is several multiples above the number of affidavits the AU is presently equipped to manage, assuming the calculations provided above. These calculations seem to affirm the views that resourcing issues at the AU now constitute the critical bottleneck, whatever may have been the case in the past.

(U) NSIRA also heard views about the importance of mentoring of new warrant counsel by experienced warrant counsel, and how NSLAG must make this a priority. This includes the need for junior lawyers to be trained on matters pertaining to CSIS tradecraft and technology.

(U) NSLAG recruitment also emerged as an issue in NSIRA’s discussions. NSLAG is regarded by other components of Justice as too close to its client and concerned with maintaining an ongoing relationship with the client, a characterization regarded as unfair by the interviewees who addressed it. Morale in NSLAG was badly affected by the 2020 FC 616 saga. NSLAG’s practice area is also, from the perspective of many lawyers, obscure and narrow, and not necessarily perceived as part of a Justice lawyer’s ideal career path. Employment at NSLAG requires enhanced security clearance, including a polygraph. The clearance process may be lengthy, and prospective employees may lose interest in the interim. These factors together contribute to NSLAG recruitment challenges.

(U) NSIRA notes that the range of professional backgrounds among counsel seems to be increasing, and more NSLAG warrant counsel have prior experience with NSIRA was told NSLAG has been encouraged to hone its public law expertise, as well as recruit lawyers with criminal law experience. NSIRA welcomes these developments and will consider NSLAG’s evolution in future reviews.

Recommendation no. 15: NSIRA recommends that NSLAG be staffed by a complement of counsel and support personnel sufficient to ensure that CSIS operations are not impeded by resource limitations at NSLAG.

e) Revamping the Independent Challenge Function

(U) The warrant application process is buttressed by a review of the near-final affidavit by an “independent counsel” (IC) – in practice, a lawyer drawn from the National Security Group (NSG) of the Department of Justice. “Independent” in this context means, therefore, at arm’s length from CSIS and NSLAG and otherwise not implicated in the warrant process.

 i. The Imperfect Independent Counsel Model

(U) The IC position was created in 1988 following the 1987 “Atwal” matter in which extensive errors were made in a CSIS warrant application (Annex A). In its 1986-1987 Annual Report, SIRC noted that the Solicitor General in consultation with CSIS should consider whether there ought to be a devil’s advocate position at some stage of the warrant process to argue the case against the warrant. The position of the devil’s advocate was described as an official appointed to ensure that all aspects of a matter are fully considered.  The following year, the “devil’s advocate” position had been established, yet, SIRC noted that, “at present the devil’s advocate does no more than ensure that the information CSIS intends to cite in a warrant application is accurate. We had in mind, rather, someone who would challenge the need for a warrant at all – someone to make the case that the proposed target (who does not of course even know a warrant is being sought) might make.

(U) Ultimately, very little has NSIRA was informed that the primary goal of the IC is to “ensure that, as much as possible, factual mistakes don’t make their way into the material that is submitted to the Court”. Scrutiny of the warrant is done through reviewing documents to ensure that factual assertions in the affidavit are accurately sourced.

(U) The IC is charged with playing a fact-checking function, described as largely a form of checking the characterization of facts in the affidavit and source précis against the source material. NSIRA was informed that NSLAG and CSIS were once more resistant to questioning by the IC. This situation has reportedly improved in the last several years, with counsel and CSIS described as now accepting of this querying.  In reality, however, changes proposed by the IC are usually very minor. Every once in a while, IC reported finding contradictions in the source material relevant to credibility issues, or treatment in the affidavit that were not justified.

(U) There will always remain inherent limits to the role of an IC coming at the end of the process. It cannot protect against all duty of candour shortcomings. Additionally, NSIRA noted a number of factors that have contributed to the inability of the IC to perform a robust challenge function:

  • Lack of policy and training: short of a two-page document outlining the description of the IC function, there are currently no up to date internal policies, guidelines, or criteria governing the expectation or mandate associated with the IC role – much depends on the individual expertise of, and investment of effort by, the IC. NSIRA was informed that typically new IC shadow senior IC counsel on their applications before being given their own. There is no official training program; counsel are given a binder of historical documents outlining the genesis of the IC role and where necessary may be given additional training on how the warrants process works. Mentoring may therefore be inconsistent due to the absence of a standardized training program and clear descriptions of the required functions of the IC.
  • Lack of knowledge: at NSG, counsel conduct their IC role as a supplement to their main legal work, involving among other things Canada Evidence Act s. 38 proceedings. By one estimate, IC work constitutes less than 5% of what NSG counsel do, and the NSG does not otherwise have any involvement in warrant-related activities. The IC have little visibility on developments in the Federal Court, including on the specific CSIS warrants they have challenged. There is no formal debrief mechanism, no proactive sharing of classified reasons, and NSG counsel neither convene their own best practices/issue sharing sessions nor participate in NSLAG’s sessions discussing emerging issues relevant to warrant practice. Some IC noted that this lack of exposure to warrant-related activities results in a lack of knowledge needed to perform a more probing review or address broader issues beyond fact checking. These knowledge constraints mean that it is extremely unlikely that the IC will be able to ask probing questions of the sort necessary to unearth the duty of candour issues stemming from possible issues on how a warrant might be executed – the second class of candour issues noted above. Meanwhile, counsel who may have this relevant experience, joining NSG from NSLAG, are required to wait a year before undertaking any IC functions. This means that often by the time they inherit a warrant file they are likely no longer current on recent CSIS practices.
  • Lack of access and time: the IC does not currently have timely access to the breadth of underlying information that would be required to play an authentic challenge role meaningfully. The IC does not receive important components of the warrant application in advance, including the source précis, and is often provided with very short deadlines for reviewing documents. While ICs have recently obtained some on-premise (CSIS) access to these other materials, this sort of advance review is uncommon. The IC is not encouraged or provided with sufficient time to fully test the theory of the case presented in an application as a form of “red team” exercise. Nor can they be expected to counter the recurring omissions issue, discussed above. It is unlikely, therefore, that the IC is fully effective in addressing candour issues resulting from failure to disclose information material to credibility.

(U) The result has been an IC role that is often regarded as more clerical than substantive, designed to cite check rather than assertively peer review. Indeed, the majority of interviewees involved in the warrants process regarded the IC as unhelpful as a form of quality control. Recent changes in the CSIS warrant process indicate that the IC “challenge” is to be completed one day prior to the WRC and once the affidavit has already been circulated to WRC participants. This change is further reflective of the general view that the IC serves only to fact check or that nothing substantial will arise from the challenge that necessitates changes prior to the WRC. Some interviewees doubted that the IC’s role was necessary – a good, well-supported affiant should suffice to guarantee the facing. NSIRA has commented above on how professionalized affiants are able to contribute to quality control.

(U) Still, NSIRA believes that the presence of an independent challenge in the system is necessary. NSIRA fears, however, that the current IC is largely a pro forma feature of the CSIS warrant process, giving the impression of a robust check and balance without accomplishing this objective. NSIRA remains unpersuaded that a robust devil’s advocate is best situated at Justice, drawing on lawyers from NSG. As noted above, while some individuals have a background involving warrants of various sorts, NSG lawyers are not, in their role, experts in warrants or necessarily knowledgeable about CSIS. Nor does NSG have any formal role in the warrant approval process. NSG would appear simply to be a convenient place to situate the IC, among lawyers who are security-cleared for very different functions. Put another way, a robust devil’s advocate function has yet to be created, and there is no reason to prefer it be situated in another branch of Justice. As discussed next, NSIRA would propose the creation of this function in the third agency of government whose precise role is oversight of the CSIS warrant process: Public Safety.

ii. Reconceiving Public Safety’s Oversight Role

(U) Public Safety Canada is the vessel through which the Minister exercises their oversight role, one intended by Parliament to be robust. The Minister’s role in the warrants regime is enshrined in legislation. Section 21 of the CSIS Act mandates that an application for a warrant may only be filed “having obtained the Minister’s approval”. The Minister’s role on section 12 warrants therefore requires that the Minister is aware of the full implications of the application, including determining if the intrusive methods to be used are justified by the gravity of the threat to the security of Canada.

(U) Yet, Public Safety has not had full visibility on the various aspects of the warrants application. There has traditionally been an information asymmetry favouring CSIS with whom the information resides. This challenge was further exacerbated by capacity issues at Public Safety, including limited ability to access information and knowledge necessary to assess risk for the Minister. The 2019 Ministerial Direction for Accountability (2019 MD) and the Framework for Cooperation between Public Safety and CSIS, sought to decrease the information asymmetry problems and increase ministerial oversight of CSIS. Pursuant to section 8 (i) of the Framework, CSIS must update Public Safety on reviews conducted by NSIRA. NSIRA interprets this obligation to mean an ongoing commitment by CSIS to provide periodic updates on the progress of reforms to the warrant process including the implementation of the recommendations in this review which will inevitably affect warrant applications.

(S) Functionally, Public Safety officials review all warrant applications with the support of legal counsel assigned to the Once the warrant application is received by Public Safety, officials will typically review the warrant for: clarity and logic; legal issues; candour issues; policy considerations; and additional considerations such as issues related to the impact on Canadians. The Public Safety delegate will attend the WRC. Following the WRC, and once the warrant has been reviewed, Public Safety officials draft a briefing note summarizing the nature of the threat posed by the target of the warrant, along with a recommendation memorandum for the Minister’s consideration. If approved, Public Safety sends the application back to CSIS to be filed in Court.

(U) Some Public Safety practices are of relatively recent vintage, prompted to some large degree by 2020 FC NSIRA cautions, however, that Public Safety is not well positioned to perform a thorough challenge of the warrant application. First, asymmetrical access to information means that Public Safety does not review the ingredients comprising the warrant application, including the source file materials or even the source précis. It would not be realistic, in our view, to expect Public Safety to audit the full information trail leading to the warrant application – it will never be able to cure a “recurring omissions” problem. Again, NSIRA believes skilled affiants in the AU validating information received from the regions and performing peer reviews of each other’s work product constitute the best means of verifying inclusion of the correct information.

(S) On the other hand, Public Safety should be positioned to solve systemic and governance issues giving rise to the second category of duty of candour issues noted in this review – those stemming from issues underlying the warrant and material to a judge’s exercise of discretion. As noted by Justice Brown in reference to the failure of CSIS to flag high-risk human source operations, which were subsequently the subject of a warrant application before the Court: “the responsibility for fully informed decision-making lies on every person participating in the decision”. Situated at some distance from CSIS and warrant counsel, an adequately staffed and expert Public Safety vetting team should contemplate the blind spots from which those closer to the process may suffer. Indeed, NSIRA learned that Public Safety, even as presently constituted, at times raises such issues. In this manner, Public Safety is in a much better position to anticipate lurking candour issues than is a lawyer at NSG, tasked with conducting an IC as a secondary function of their For this reason, NSIRA favours a new reform that would bolster Public Safety’s vetting process, and would replace the NSG IC, all in service to the Minister’s legislated oversight role.

(U) To this end, NSIRA favours a devil’s advocate model that helps meet the Minister’s own obligation to oversee the warrant process. That is, NSIRA recommends the creation of a role meeting the original vision proposed by SIRC in the report noted above: “someone who would challenge the need for a warrant at all – someone to make the case that the proposed target (who does not of course even know a warrant is being sought) might make”. The counsel should be as assiduous as a defence lawyer would be, defending a client in a fully adversarial process. They should know, and know how, to ask questions about the information supporting the warrant, its planned execution, and any relevant surrounding context that might escape the attention of a lawyer less familiar with warrants or CSIS procedures and functions, or might be lost to tunnel vision among those closer to the In this manner, NSIRA suggests that this person, working with Public Safety’s warrant vetting team, should be well-situated to anticipate the second category of candour issues discussed in the report.

.(U) Right now, Public Safety is supported by its own Justice departmental service unit. NSIRA suggests that unit should be supplemented by a seconded counsel with practical warrant experience employed at the Public Prosecution Service of Canada, the private sector or elsewhere, independent from Justice management, and not otherwise involved in CSIS warrant applications. This counsel would be deployed for the specific purpose of supporting a Public Safety warrant vetting team in its challenge function. This challenge and review of the warrant conducted by the seconded counsel must be documented in a manner that is visible to the Minister when considering whether to approve the proposed warrant application. NSIRA cautions that the purpose is not to increase the number of steps or the length of time the application takes. Rather, abolishing the current IC model entirely in favour of a true devil’s advocate conducted as part of ministerial oversight would thin the process in addition to reinforcing it with a built-in, thorough challenge function.

Finding no. 20: NSIRA finds that the “independent counsel” (IC) role falls short of creating a thorough challenge function.

Recommendation no. 16: NSIRA recommends that the function of the Independent Counsel as performed by NSG counsel at the Department of Justice be eliminated, in favour of a new challenge function, analogous to the role a defence lawyer would play were warrants subject to an adversarial process, situated at Public Safety and supported by the Public Safety vetting team, and performed by a knowledgeable lawyer from the Public Prosecution Service of Canada, the private sector, or elsewhere, who is independent from Justice management and not otherwise involved in CSIS warrant applications.

f) Submission to the Federal Court

(U) The final stage in the warrant process is the proceeding before the Federal Court. No warrant exists until authorized by the Federal However, trust between the Federal Court, NSLAG and CSIS has clearly been strained by the long history of duty of candour failures.

(U) The Court is perceived by interviewees as more assertive now than in the past. Some interviewees described doubts about the degree of control exercised by the Court, sometimes seeing it as more akin to a review function and less like the classic judicial control exercised by a court in issuing (or not) warrants. Others rejected any notion that Justice questioned the legitimacy of the Court’s approach. Still, the institutions implicated in the warrant process seem to have entered a cycle in which duty of candour failures have contributed to a climate of mistrust involving closer scrutiny and more searching judicial control, which inevitably heightens anxiety at the CSIS level about operational implications and reputational risk. It has also been the source of some uneasiness at Justice.

(U) Of particular note, interviewees told NSIRA that anticipating in advance the full range of considerations relevant to a judge in exercising their discretion is not easy, especially since judges reportedly focus on different concerns depending on the case before them. This creates a residual category of information that may have to be provided with the application. CSIS and Justice reportedly now err on the side of being over inclusive.

(U) Because of all of these factors, the warrant application process currently operates like a ratchet, as ever more detail is layered into the affidavit and supporting documents in an effort to anticipate and avoid a new duty of candour failure. There is some “cut and paste” possible for recurring issues, but this material must be tailored to each warrant, and then re-vetted through the bureaucratic warrant approval process. The resulting warrant applications become more lengthy, complex, and time-consuming to prepare.

(U) Breaking this cycle, however, requires restored credibility through change at CSIS and Justice, not resistance. NSIRA believes that doing so requires an embrace of the recommendations made in this review. It also notes other ways in which CSIS and Justice could show a commitment to candour, possibly alleviating the workload involved in warrant applications. NSIRA noted one approach suggested by our interviewees: warrant applications would describe information that is excluded (because it is believed not to be material) in sufficient detail that a judge might ask for its disclosure should they wish. Justice could also seek direction from the Court in the form of a practice direction or annotated standard warrant templates, or the bench and bar system recommended by the Segal report.

g) Doubts Arising on Warrant Execution

(S) Once a judge issues a warrant, CSIS may execute the warrant. That execution must comply with the scope and terms of the After the warrant’s issuance, CSIS and Justice conduct a debrief with the affiant, lawyer, the relevant headquarters desk and the responsible officials at the regions. This process includes a “reading of the warrant”, designed as NSIRA understands it, to help inform execution. NSIRA was told that this debrief is sometimes regarded as vague and unhelpful, and that those charged with overseeing warrant execution had no resources to translate “warrant language” into techniques and powers they could use.

(S) The warrant coordinators in the regions lack formal training, and learn their task on the job – existing training is too broad and abstract, unconnected to the practical scenarios arising in the execution of warrants343. In consequence, expectations accrue as myths rather than clearly understood legal standards. NSIRA was told there were perceived disparities between what seemed to be on the face of the warrant and what lawyers described as the judge’s intent. This sort of ambiguity reportedly gives rise to “invisible rules”. The regions are extremely uncomfortable with implied permissions, preferring tangible authorizations in warrants. [discussion of the detrimental effects on and risks to operations]

(U) Finding no. 21: NSIRA finds that the CSIS regional warrants coordinators have not received sufficient training enabling them to translate the contents of the warrants into advice on proper warrant execution.

Recommendation no. 17: NSIRA recommends that CSIS regional warrants coordinator positions receive adequate training, and that CSIS professionalize the position and enable warrant coordinators to more effectively translate the content of warrants into advice on warrant execution.

C. Investment in People: Training

(S) As the discussion in this report demonstrates, training and institutional knowledge are recurring themes in this Most interviewees noted that they had not received specialized training prior to assuming their specific role in the warrant process, instead learning through word of mouth from others doing the same function. Some interviewees clearly felt unprepared for their role, and regretted the absence of systematic training. Several others tied the lack of training and the paucity of modernized processes and policies to compliance failures. CSIS is to a certain extent alive to the shortcomings in its training programs and has itself noted that:
“CSIS is currently not a learning organization and does not have a learning culture. There are insufficient training opportunities to build and sustain a modern professional intelligence service that operates in a continuously evolving and complex environment, it is evident that the exponential needs across operational and corporate requirements has not kept pace with the current L&D staffing and funding allocation”.

(U) The inadequacies of training featured in a recent internal review of the warrant process. NSIRA embraces its recommendations on the need for reform in this area. NSIRA emphasizes especially, however, the need for education through scenario-based learning, and not simply training through the passive consumption of learning materials.

(S) CSIS’s Learning and Development (L&D) branch has considerably revamped both the intensive program taken when employees join CSIS as Intelligence Officers (IOs), and the intensive course IOs take after several years at headquarters, before deployment to the regions. For instance, the IO Entry Training (IOET) which is largely content and theory heavy, is being overhauled to include scenario-based learning. L&D has embraced learner-centered approaches, with high instructor to trainee ratios. In its most recent iteration, the [training program name] now trains IOs in scenarios relevant to the duty of candour, including [training program content] capturing details related to legal credibility and conditioning passing grades on responsiveness to these matters.

(U) Trainers – IOs themselves participate in train-the-trainers programs. These trainers may themselves cycle to operational roles, where they are well-positioned to transmit expertise and mentor others. Meanwhile, NSLAG will work with CSIS’s policy centres and provide feedback on learning modules raising legal issues. The [Name] will raise issues that may involve legal dilemmas. However, [Name] training does not address legal issues per se – rather the purpose is to train IOs in recognizing legal doubt, necessitating consultation with NSLAG. IOs are not trained, in other words, on answers to legal questions, so much as trained to recognize the existence of legal issues. Precise legal answers, it is feared, change with time, and a decision has been made to train a reflex to seek legal answers from NSLAG. NSIRA notes, however, that the IOET and the [Name]  come relatively early in an IO’s career and that CSIS has no ongoing, formal professional development requirements. NSIRA further notes that warrants- related training including duty of candour is of sufficient importance to necessitate annual mandatory warrant training for all operational personnel. This would allow operational personnel to remain apprised of changes in the warrants process as well as changes in the operational environment including technological advancements which may influence their assessment of when a warrant is required.

(S) Aside from IO training early in an IO’s career, specialized training in CSIS’s various specialized trades is uneven. Most of the interviewees indicated they had received no formal training beyond that at the beginning of their careers, with a few exceptions (such as [Branch Name]). Where there is in-house training, NSIRA’s view is that it is often relatively informal and lacks some of the experiential features that the modern has developed. L&D is not responsible for training in specialized sub-trades or units of CSIS, although they may be consulted on design such that unit wish to establish a training system. This creates a gap in training for individuals who are not within the IO career stream.

(S) Following 2020 FC 616, CSIS implemented organization-wide mandatory training for all operational employees on the duty of candour. The thirty-minute training was contained in an online module that employees complete.  The module contains 22 slides discussing the duty of candour, including prior breaches and the role of every individual in ensuring that duty of candour is met. The module contains only two theory-based questions, no scenario-based training and may be completed in half the time by employees. This type of training reflects concerns voiced during the review that CSIS cannot build a compliance culture by PowerPoint training, and complaints that training included too much pro forma box checking.

(U) In sum, the training culture at CSIS has been largely a “once and done” approach to formal skills acquisition. Moreover, NSIRA was led to believe that prior generations of the entry level and pre-regional deployment training courses were less robust than the present generation, and depended on more passive forms of education (such as PowerPoints). Bringing modernized training to more advanced IOs and standardized training of any sort to non-IOs appears to remain a challenge. L&D is not adequately resourced at present to expand a formal CSIS training footprint, despite considerable demand for specialized training. Noteworthy, L&D has recently received CSIS management approval for their business plain to establish three regional training hubs to incorporate modern training at the regional level and enhance the skill set of IOs whose training may predate the existing training curriculum.

(U) While both IOs and non-IOs noted the lack of training as a major issue, it was more pronounced with non-IOs. NSIRA heard from non-IOs including managers, analysts and technical experts that they did not receive the benefit of any form of formal training upon joining the organization. Many had to ask for specific mentorship, while others have found that they are regarded as the most senior subject matter experts, leaving them with no mentorship options.

(U) NSIRA observes that a commitment to training is only as real as the importance and resources devoted to Accordingly, training will succeed only to the extent that employee time is freed up to allow the acquisition of new skills and knowledge. In this respect, some interviewees expressed doubt that units already confronting personnel shortages will succeed in building human capital.

Finding 22: NSIRA finds that CSIS lacks long-term training programs for Intelligence Officers.

Finding 23: NSIRA finds that CSIS has failed to provide systematic training programs for “non-Intelligence Officers”.

Finding 24: NSIRA finds that the CSIS’s Learning and Development Branch has not been sufficiently resourced to develop and administer comprehensive training programs, especially in specialized areas not covered by the training offered for Intelligence Officers early in their career.

In view of these findings, NSIRA recommends that:

Recommendation no. 18: CSIS adequately resource and regularly deliver evergreen scenario-based training programs for all CSIS employees, including;                                                     

  • annual, comprehensive, warrant training for all operational employees;
  • specialized onboarding training for all employees not part of the Intelligence Officer program; and
  • continued long-term training for all specialized

5. Consequences Of Systemic Problems

(U) This report ends with an examination of, and associated observations on, cross-cutting governance and cultural issues that stem, at least in part, from challenges characterizing the provision of legal advice and the warrant process. NSIRA divides these broad, cross-cutting phenomena into two categories: morale and attitudes; and, performing the mission.

a) Morale and Cultural Resistance to Change

(U) NSIRA heard and read much about very low morale at CSIS — a central concern not only to individuals whom NSIRA interviewed but also in employees’ resignation and retirement exit. There are likely many reasons for this morale problem. The systemic and governance interviews issues in the warrant process are part of them. Morale is injured by a warrant acquisition system that seems to impede performance of the mandate while at the same time being the source of regular reputational crises stemming from duty of candour failures.

(U) At the same time, employees see themselves as participating in a rigorous process. Indeed, so rigorous is this process that employees are frustrated that too few warrants are being sought. They feel caught in a no-win environment compounded by the bureaucratic burden associated with having a warrant application reach the Court.

(U) NSIRA notes that those disillusioned by seemingly unending compliance issues reportedly fall into three categories, reflecting sometimes quite different perspectives: those viewing compliance measures as an inconvenience; those who do not understand the purpose of compliance measures; and, those who viewed them as a manifestation of diffused or insufficient governance responsibility.

(U) First, some interviewees stated that, while duty of candour failures at the Federal Court have resulted in further disclosure obligations and demanded additional undertakings, these failures are perceived as a risk to be managed rather than a problem to be solved. For this group, the implication is that the rule of law is not a grounding consideration. Indeed, some interviewees did doubt the existence of a compliance culture, or that compliance with duty of candour standards was embraced seriously as part of confidential source management.

(U) Others had very different views, and regarded compliance failures as tied to the lack of training and the paucity of modernized processes and policies. CSIS has historically under- resourced policy, compliance and training. Even where policies are changed, NSIRA was told that simply announcing new protocols cannot effect change – and indeed, they may go unread. Some interviewees reported, for example, that Project [Name] communications are ignored. CSIS is developing policy centres, but employees may have a foggy understanding of the role of these units, and may not be sufficiently attuned to issues to know when to seek expert input.

(U) With regards to the third category, NSIRA heard concerns about flawed governance in warrant and compliance matters. Some interviewees expressed concern about governance vacuums. In the eyes of some, managers have done too little to redress employee uncertainty about rules, and indeed even managers at the executive level reportedly sometimes lack understanding of applicable rules. NSIRA heard concerns that employees are reportedly not rewarded for compliance initiatives, and indeed some personnel implicated in poor compliance conduct have been promoted. CSIS was described by some as possessing a culture in which bad news does not travel upwards, and one in which managers resist lessons-learned analysis and reporting, and prefer positive spins on errors.

(U) For other interviewees, CSIS allegedly has a zero-fail approach to some compliance issues, producing a brittle, risk averse working For instance, within CSIS there is reportedly no attitude that in litigation, one wins some and loses some. A troubled warrant application is widely regarded as disastrous, and career impairing. Indeed, interviewees described an internal fear of making mistakes, and a punitive, “call out” culture when mistakes are made. The aim is “not to fail” in order to be promoted, leading to a cautious culture in which some people prefer not to act or ask questions. This culture likely undergirds the multiplicity of warrant steps, and the diffusion of responsibility. It may also be a partial explanation for why some legal doubts are not brought before the court for resolution through the warrant process.

(U) In crafting its recommendations, NSIRA aligned the core warrant responsibilities to the legislative accountability framework while ensuring that those controlling the process can set a careful watch over one of the drivers of morale within their organization.

b) Performing the mission

(U) In this report, NSIRA has identified several governance and cultural The lack of alignment in the way Justice provides legal services with the needs of CSIS, the delay inherent to the quest for legal advice, and the disconnect between the content of legal advice and the operational imperatives of CSIS may not completely explain the current climate. However, this situation can only have compounded other possible causes, if any, beyond the parameters of this review. The problems have resulted in a culture of distrust towards Justice counsel and a systemic reaction whereby CSIS sometimes avoids seeking legal advice.

(U) While NSIRA does not question the need for Justice to speak with “one voice”, the governance structure put in place to safeguard consistency cannot override another fundamental goal, which is to allow its client to comply with and to respect the rule of law.

(U) To become “client-centric” as promised in Justice’s VISION Project, Justice must go from being perceived as a roadblock, to a frank and forthright advisor fully attuned to operational objectives. To achieve that goal, several interconnected recommendations of this report need to be implemented. They reach into Justice’s governance and culture. On the governance aspect, they relate to training, to prompt and clear advice-giving, and to early and extended availability of counsel. On the culture aspect, they relate to the culture of support that goes beyond the mere provision of legal opinions constituting traffic signals – they call for counsel working as advisors opining in an iterative manner on how an intelligence operation might proceed in a manner that respects the rule of law. Providing road map-style advice does not mean Justice abandons its fearless defence of the rule of law, or its independence. It does mean that it situates this advice in a manner that best serves the shared goal of operations compliant with the rule of Changing the culture of distrust and avoidance can take time, but early, continued and consistent engagement in operations should contribute to rebuilding the relationship.

(U) The current governance of advice-giving is unnecessarily detrimental to If the course is not corrected, both organizations put at risk the fulfillment of their mandates.

(U) For CSIS, the risks to its fulfillment of its mandate arise on multiple fronts. NSIRA endorsed above the view that warrants are the “lifeblood” of CSIS. CSIS members may, however, vary in the degree to which they appreciate the significance of warrants. Many interviewees adhered to what may be called a national security culture, in which success is about leveraging CSIS’s mandate to contribute to Canada’s national security. The objective is to provide useable, lawfully-collected information of value to the government of Canada. In this view, the entire CSIS apparatus needs to understand the objectives behind the collecting of information, and see itself as engaged in a collective enterprise, rather than discrete, atomized endeavours. Disillusionment, NSIRA concluded, often reflected recognition of how warrants (and law) are increasingly important in intelligence operations, but at the same time hard to obtain. With the increasing dominance of electronic communications, what was once standard pre- or non-warranted tradecraft is now increasingly crossing the line into activities requiring warrants. Warrants, in other words, reach far into CSIS’s traditional tradecraft.

(U) It was, however, the considered opinion of a number of our interviewees that too many CSIS investigations are now stranded by the warrant process. That process was sometimes compared to winning a lottery, not because of lack of success at the Federal Court but because of the resource intensity of getting the application to the Court.

(S) NSIRA was also advised of investigators [discussion of how collection activities are affected] doing their best to advance investigations [discussion of effects on collection activity]. Leaving to individual interpretation which  [collection activity] may be used could result in boundaries being pushed, compounding grey zone legal issues and reputational risk if these practices then culminate in review or court proceedings. Further, while warranted collection might clarify whether CSIS’s reasonable belief that the individual is engaged in threat activities is well-founded, other techniques may leave the target in limbo. [discussion of how collection activities are affected]. At the same time, it risks focusing the state’s attention on people for greater periods of time because [discussion of how collection activities are affected]

(U) There was widespread support for the view that the warrant process should not be the bottleneck on warranted activities – that any bottlenecks should be driven by operational imperatives. NSIRA was told the metric of success for a reformed warrant process amounts to: more warrants, more closely tailored to the threat, with shorter and more detailed threat assessments that simultaneously meet the court’s expectations.

(U) As the calculations in the preceding sections show, the question of how many warrants CSIS should transact annually was not easily The near-consensus was, more than the number that have been sought in the recent past. The expectation is that operational imperatives in an era of complex threats and burgeoning electronic communication will require more warranted activities. The number of novel issues can only increase, compounding the need for legal advice, which highlights the need for cooperation with Justice.

(U) Given the challenges identified in this report, NSIRA could detect no clear path to achieving such an objective under the status quo. In these circumstances, the warrant process risks remaining the worst of all worlds: a system that makes it too hard for CSIS to perform the mandate given to it, while at the same time doing too little to safeguard against legal error.

(U) This report has identified many governance issues at both Justice and CSIS. The deficiencies in information management; the lack of training; the multiple steps in the warrant process; the absence of an efficient challenge function; the lack of understanding of the decision-making process; and the absence of clear accountability lines all go to the heart of the very questions that characterize the notion of governance: How are decisions made? Who makes them? Who is accountable for them?

(U) Reforms should allow for clear answers to these questions. Among other things, NSIRA has recommended that the CSIS Director assume more immediate responsibility for the Affiant Unit and that the Minister and Public Safety host a more immediate role in challenging warrants. These structural reforms, however, will only produce positive changes if accompanied by the implementation of the other recommendations, especially those sustaining the Affiant Unit.

(U) In sum, this review was sparked by a compliance failure in a duty of candour matter. It concludes that repeated failures in this area are both caused by, and cause, deep-seated governance and cultural patterns. This vicious cycle has compounded the challenges of reform in the warrant acquisition process. NSIRA agrees with the 2020 Rosenberg Independent Review that “a precondition to successfully implement the recommendations is to address the cultural issues around warrants”.

(U) The challenges communicated by many interviewees will not disappear unless widespread governance reforms facilitate an improved warrant process. Cherry-picked changes or paper reforms that mask governance and cultural issues, without addressing them, will suffer the ignominious fate of prior rounds of changes: they will not fix systemic issues. This will require a major effort. In this review, NSIRA has proposed a series of reforms. No single recommendation made here will alone resolve the source of systemic issues in the warrant process. CSIS and Justice shall need to pursue recommendations as a package.

(U) Finding no. 25: NSIRA finds that CSIS and Justice are at risk of not being able to fulfill their respective mandates. No one reform is likely to succeed unless each is pursued as part of a coherent package. No package will succeed unless backed by prioritization at senior levels, and the stable provision of resources, including people with the means and institutional knowledge to see reforms through. And no reform initiative will succeed unless accompanied by clear performance indicators, measured and analyzed regularly to track progress.

In view of NSIRA’s findings above, and of prior unsuccessful reforms, NSIRA recommends that:

(U) Recommendation no. 19: The recommendations within this review be treated as a coherent package and that progress and outcomes in implementing these recommendations be tracked, allowing management, the Ministers of Public Safety and of Justice, and NSIRA, to assess the efficacy of reforms and course correct if necessary.

(U) NSIRA intends to launch a follow-up review, within two years, which will measure progress at CSIS, Justice and Public Safety in resolving the systemic issues with the warrants process addressed by this review. Moreover, in other regular reviews implicating warrants, NSIRA will document recurrences of systemic problems. In the meantime, since this review originated with a decision of the Federal Court, it is vital that the Minister and CSIS share it in its full form with the designated judges of that court.

In recognition of the fact that this report followed a recommendation of the Federal Court, NSIRA in turn recommends that:

(U) Recommendation no. 20: The full, classified version of this report be shared with the designated judges of the Federal Court.

Share this page
Date Modified:

Review of Departmental Frameworks for Avoiding Complicity in Mistreatment by Foreign Entities

Review Backgrounder

In 2019-2020, NSIRA conducted its first interdepartmental review on the implementation of the 2017 Ministerial Directions on Avoiding Complicity in Mistreatment by Foreign Entities (2017 MD). The review set out to build NSIRA’s knowledge of the information sharing process adopted by the six departments that received the 2017 MD.

NSIRA conducted a case study for each department that had operationalized the 2017 MD. NSIRA noted significant differences in the six departments’ implementation and operationalization of information sharing processes. NSIRA found that CSE, CSIS and the RCMP had implemented the 2017 MD; DND/CAF was implementing the final elements of the 2017 MD; GAC had not yet fully implemented the 2017 MD; and, the CBSA had not yet operationalized the 2017 MD.

NSIRA examined and found differences in how high-risk decision-making is removed from operational personnel who may have a vested interest in the sharing. CSE and the RCMP had the most independent processes; GAC removed high-risk decision-making from front line personnel, while CSIS and DND/CAF decision makers had a direct operational interest in sharing information. NSIRA recommended that Departments ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested in the outcome.

NSIRA also found a lack of standardization in information sharing risk assessments for both foreign countries and foreign entities. This issue has been noted in other NSIRA information sharing reviews.

In 2019, parliament passed the Avoiding Complicity in Mistreatment by Foreign Entities Act, which in conjunction with the subsequent issued Orders in Council (OIC’s) codified many of the provisions of the 2017 MD and left the essential prohibitions and limits unchanged. Noteworthy, the six departments examined in this review are also the same departments for which there is an obligation to issue OICs pursuant to the Act. This review set out the foundation that has assisted and facilitated NSIRA’s subsequent mandated information sharing reviews.

Publishing this review aligns with NSIRA’s efforts at increasing transparency and being more accessible to Canadians through its work.

Date of Publishing:

1. Executive Summary

In 2011 and again in 2017, ministers issued direction (hereafter Ministerial Direction or MD) to a number of departments setting out how to manage the risks of mistreatment posed by the sharing of information with foreign entities. Most recently, Parliament passed the Avoiding Complicity in Mistreatment by Foreign Entities Act (ACMFEA). In September 2019, direction under the ACMFEA was issued to twelve departments, six of which had never before received formal direction regarding information sharing with foreign entities.

This review set out to build NSIRA’s knowledge of the information sharing processes adopted by departments under the 2017 MD. The direction issued pursuant to the ACMFEA in September 2019 codified many provisions of the 2017 MD and left the essential prohibitions and limits unchanged. As such, this review provided a foundation that will expedite and facilitate NSIRA’s future information sharing reviews.

The review focused on the six departments that had received the 2017 MD: the Canadian Security Intelligence Service (CSIS), the Communications Security Establishment (CSE), the Royal Canadian Mounted Police (RCMP), the Canada Border Services Agency (CSBA), Global Affairs Canada (GAC), and the Department of National Defence and the Canadian Armed Forces (DND/CAF).

Observations and Recommendations

Degrees of implementation vary across departments

NSIRA noted significant differences between the six departments with regard to the level of implementation of information sharing processes. In summary:

  • CSE, CSIS and the RCMP have implemented the 2017 MD.
  • DND/CAF is in the process of implementing final elements of the 2017 MD.
  • GAC has not yet fully implemented the 2017 MD.
  • In practice, CBSA has not yet operationalized the 2017 MD.

The concept of “substantial risk” of mistreatment is not defined

Like the 2017 MD, the ACMFEA and its associated direction prohibit information sharing that would result in a “substantial risk” of mistreatment. Neither the ACMFEA nor its direction include a definition of substantial risk, however, despite the centrality of this concept to the regime. A definition of substantial risk existed in both the 2011 and 2017 MD; its absence now raises concerns about its interpretation in future.

Recommendation: The definition of “substantial risk” should be codified in law or public direction.

Departments vary with respect to the independence of their decision-making

  • CSE and the RCMP have the most independent processes.
  • The information sharing processes implemented by GAC to date remove high- risk decision-making from “front line” personnel.
  • At CSIS and DND/CAF, decision-makers typically have a direct operational interest in the sharing of information.
  • CBSA has not yet operationalized its information sharing processes.

Recommendation: Departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested in the outcome.

Lack of standardized information sharing risk assessments

Under the 2017 MD, GAC, CSIS, CSE, and the RCMP all maintain their own sets of foreign country and/or entity profiles, while DND/CAF is currently developing its own as well. The existence of multiple different assessments is duplicative and unnecessary. It may also yield inconsistencies, as departments have at times come to quite different conclusions about foreign countries’ and entities’ human rights records and the associated risks of information sharing.

Recommendation: Departments should develop: (a) a unified set of assessments of the human rights situations in foreign countries including a standardized ‘risk of mistreatment’ classification level for each country; and (b) to the extent that multiple departments deal with the same foreign entities in a given country, standardized assessments of the risk of mistreatment of sharing information with foreign entities.

Benefits of internal information sharing process reviews

Finally, NSIRA noted that periodic internal reviews of information sharing policies and processes supported their successful functioning in the long term.

Recommendation: Departments should conduct periodic internal reviews of their policies and processes for sharing information with foreign entities in order to identify gaps and areas in need of improvement.

2. Authorities

This review was conducted under the authority of the National Security and Intelligence Review Agency Act (NSIRA Act), specifically paragraphs 8(1)(a) and 8(1)(b) as well as sections 9 and 11.

3. Introduction

Many departments and agencies in the Government of Canada routinely share information with foreign entities. Given that information sharing with entities in certain countries can result in a risk of mistreatment for individuals, it is incumbent upon the Government of Canada to evaluate and mitigate the risks that such sharing creates. This is particularly the case for information sharing related to national security and intelligence, where the information often relates to alleged participation in terrorism or other criminal activity.

Canada has made a number of binding commitments under the International Covenant on Civil and Political Rights (ICCPR), the Convention Against Torture and Other Cruel, Inhumane, or Degrading treatment or Punishment (CAT), and other international agreements. The prohibitions on mistreatment – including complicity in mistreatment – set out in these agreements are also considered to be customary international law. Some of Canada’s obligations have been incorporated into domestic law under section 269.1 of the Criminal Code.

In 2011 and again in 2017, ministers issued direction to a number of departments setting out how to manage the risks in information sharing with foreign entities. Most recently, Parliament passed Bill C-59, which included the ACMFEA. In September 2019, direction under the ACMFEA was issued to twelve departments, six of which had never before received formal direction regarding information sharing with foreign entities.

Subsection 8(2.2) of the NSIRA Act requires NSIRA to review annually every department’s implementation of the directions of the GiC issued under the ACMFEA. In 2020, the NSIRA will undertake its first such review. The purpose of the present review, however, was to build NSIRA’s knowledge and understanding of departments’ implementation of the 2017 MD. The direction issued pursuant to the ACMFEA in September 2019 codified many provisions of the 2017 MD and left the essential prohibitions and limits unchanged. As such, this review provided a valuable foundation that will expedite and facilitate NSIRA’s future information sharing reviews.

The review focused on the six departments that received the 2017 MD: CSIS, CSE, the RCMP, CBSA, GAC, and DND/CAF. NSIRA examined departments’ policies and processes as well as documents related to foreign arrangements. Where possible, NSIRA examined a single case study for each department in order to illustrate how information sharing works in practice. Given the high-level approach taken in this review, NSIRA opted to make a series of broad observations about the strengths and weaknesses of departments’ framework for information sharing with foreign entities, in the place of formal findings. Where NSIRA made recommendations, they were interdepartmental in scope.

This review focused on departmental policies and procedures for the disclosure and requesting of information involving a risk of mistreatment. It did not examine the use of information that may have been derived from mistreatment; NSIRA may review this topic in future.

4. Background

In 2011, the Government of Canada approved a general framework for “Addressing Risks of Mistreatment in Sharing Information with Foreign Entities”. The framework was the first multi-departmental set of instructions issued regarding information sharing and mistreatment. Its main aim was to establish a coherent and consistent approach across government when sharing information with foreign entities.

Later in 2011, a number of departments whose mandate related to national security and/or intelligence received Ministerial Direction on Information Sharing with Foreign Entities (the 2011 MD). Specifically, the 2011 MD was issued to CSIS, CSE, CBSA, and the RCMP. The 2011 MD, which was eventually released under the Access to Information Act, was subject to extensive criticism from non-governmental organizations, civil liberties groups, and others including the Canadian Bar Association. The main critique was that the 2011 MD did not clearly prohibit the disclosure or requesting of information entailing a “substantial risk” of mistreatment, but rather permitted departments to weigh the value of the information against the risk of mistreatment.

In 2017, the 2011 MD was replaced by a new Ministerial Direction on Avoiding Complicity in Mistreatment by Foreign Entities (the 2017 MD). The 2017 MD was received by CSIS, CSE, CBSA, and the RCMP – the departments that had received the 2011 MD – as well as by DND/CAF and GAC. The 2017 MD included numerous changes, but the most significant were clear prohibitions on the disclosure and requesting of information that would result in a substantial risk of mistreatment, as well as new limits on the use of information likely derived from mistreatment by a foreign entity. In addition, the new MD required departments to maintain policies and procedures to assess the risks of their information sharing relationships with foreign entities.

The 2017 MD further directed departments to cooperate in making assessments regarding foreign countries and entities. In response, Public Safety Canada (PS) established the Information Sharing Coordination Group (ISCG) comprised of PS and the six departments that had received the 2017 MD. The objective was to encourage interdepartmental discussions in support of a coordinated approach to the implementation of the MD.

On July 13, 2019, the ACMFEA came into force. The ACMFEA requires the GiC to issue direction to the six departments that had received the 2017 MD, and gives the GiC discretion to issue direction to other departments as well. On September 4, 2019, the GiC issued direction under the ACMFEA to twelve departments. In addition to the six mandatory departments, direction was issued to PS; the Financial Transactions and Reports Analysis Centre of Canada (FINTRAC); Transport Canada; Immigration, Refugees and Citizenship Canada (IRCC); the Canada Revenue Agency (CRA); and Fisheries and Oceans Canada (DFO). These six new departments have now also joined the PS-led ISCG.

In practice, the information sharing regime set out by the ACMFEA and the subsequent GiC direction closely resembles the 2017 MD. The fundamental limits on Canadian departments’ scope to share information remain unchanged. Notably, however, the new regime omits certain aspects of the 2017 MD. The ACMFEA and its associated direction lack the 2017 MD’s requirement that departments maintain policies and procedures for assessing the risks associated with foreign information sharing arrangements, in collaboration with other departments. More importantly, the new system omits a definition of the threshold of “substantial risk”. The ramifications of this are discussed below.

5. Observations and Recommendations

Reporting

One of the new obligations placed on departments in the 2017 MD was a requirement that they provide an annual report to their minister that included:

All of the departments that were issued the 2017 MD fulfilled their obligation to report to their respective ministers by producing a report in late 2018 or early 2019 discussing the first year of activity under the MD. At the time of writing, however, not all of the departments have issued a public report. As this was a foundational review, NSIRA did not critically evaluate the reports.

Department Report to Minister Public report Cases approved Cases denied
CBSA Provided Published 0 0
CSIS12 Provided Published 1 1
RCMP13 Provided Published 25 4
CSE14 Provided Published 1 0
DND/CAF Provided Not Published 0 0
GAC Provided Not Published 0 0

Implementation of the 2017 Ministerial Direction

When the 2017 MD was issued, departments that had already built information sharing policies and procedures under the 2011 MD found themselves at a significant advantage. CSIS, CSE, and the RCMP in particular were able to quickly adapt their existing systems to the 2017 MD. Accordingly, for departments that had not received the 2011 MD – or had not implemented it – the arrival of the 2017 MD proved more challenging.

CSE: NSIRA observes that CSE has fully implemented all of the elements of the 2017 MD. The MD’s requirements have been integrated directly into CSE’s operational policies and processes. A detailed overview of CSE’s information sharing framework and the results of the case study examined by NSIRA can be found at Annex D.

RCMP: In response to the 2017 MD, the RCMP overhauled their information sharing framework and stood up a new Law Enforcement Assessment Group (LEAG) that, amongst other things, assesses country human rights records and maintains a system for streaming information sharing requests according to risk. The RCMP is currently working to integrate these processes into their comprehensive operational manual. A detailed overview of the RCMP’s information sharing framework and the results of the case study examined by NSIRA can be found at Annex E.

CSIS: Following the issuance of the 2017 MD, CSIS quickly updated their policies and procedures. In 2018, CSIS also created a new system to implement the MD’s requirement to restrict information sharing with foreign entities that engage in mistreatment, with three levels of restriction depending on the seriousness of the problem. CSIS has informed NSIRA that it is overhauling its current policies and procedures. A detailed overview of CSIS’s current information sharing framework and the results of the case study examined by NSIRA can be found at Annex F.

DND/CAF: Although DND/CAF did not receive the 2011 MD, DND/CAF has had internal directives in place governing information sharing with foreign entities since 2010. The DND/CAF policy and process suite for information sharing was updated following the issuance of the 2017 MD to bring it into compliance with the new requirements. While DND/CAF vets partner forces, it does not yet have a fully developed system for assessing and managing the risks of sharing information with foreign entities. DND/CAF is, however, currently developing more extensive country risk profiles and a standardized assessment process that will be used to assess the risks of information sharing prior to establishing information sharing arrangements. A detailed overview of DND/CAF’s information sharing framework can be found at Annex G.

GAC: Following receipt of the 2017 MD, GAC established a new Ministerial Direction Compliance Committee (MDCC) in December 2018. The MDCC’s objective is to review requests for information sharing that may engage the MD. This is the extent of GAC’s policies and processes pursuant to the MD, however. GAC lacks any policies or procedures setting out how employees are to assess instances of possible information sharing to ensure that all appropriate cases reach the MDCC. It is insufficient to merely inform employees that they are responsible for assessing a complex legal threshold – the concept of a “substantial risk” of mistreatment at the core of the 2011 and 2017 MD as well as the ACMFEA – without guidance as to how they should proceed. As such, NSIRA observes that GAC has not yet fully implemented the 2017 MD.

GAC (cont.): Of note, GAC produces human rights reports on countries that are widely used within government to assist in assessing the risks of sharing with foreign entities. Following the 2017 MD, GAC added a subsection specific to mistreatment to these reports. A detailed overview of GAC’s information sharing framework and the results of the case study examined by NSIRA can be found at Annex H.

CBSA: In October 2018, CBSA issued a revised high-level policy document in response to the 2017 MD. The document did not include concrete processes for identifying and handling instances of information sharing involving a risk of mistreatment, however. CBSA employees thus lack effective guidance with which to discharge their responsibilities under the MD. CBSA also has no process for assessing the risks associated with specific foreign countries and entities, as required by the MD. CBSA has since drafted processes and additional policies, but they have not yet been finalized or invoked. Given these significant gaps, NSIRA observes that CBSA has not yet operationalized the 2017 MD. CBSA has informed NSIRA, however, that it intends to introduce significant improvements over the coming year. A detailed overview of CBSA’s information sharing framework can be found at Annex I.

Additional observations are included in the department-specific annexes referenced above. It should also be noted that NSIRA examined departmental policies and processes at a high level, and as such future reviews may make additional findings and recommendations regarding policies and processes. Moreover, a number of departments are in the process of revamping their information sharing practices, including in particular CSIS and DND/CAF.

In its survey of departments, NSIRA noted varying levels of rigour and consistency with regard to record keeping. Accurate and detailed records of deliberations and reasoning in support of decision-making related to information sharing with foreign entities are necessary to support accountability, particularly in light of the Supreme Court’s recent decision in Vavilov. NSIRA may return to this subject in future years.

In June 2019, the RCMP conducted an internal review of the framework and policies in place for its information sharing policies and procedures. The review identified certain shortcomings with regard to policies, processes, training, and resourcing. Based on the draft provided, NSIRA observes that the review was candid and thorough. The review is currently being used to guide improvements. Periodic internal reviews – such as the one conducted by the RCMP – should be considered a best practice.

Recommendation no. 1: Departments should conduct periodic internal reviews of their policies and processes for sharing information with foreign entities in order to identify gaps and areas in need of improvement.

Independent Decision-Making

The concept of risk mitigation is key to the information sharing frameworks of departments. When information sharing would result in a substantial risk that an individual would be mistreated, the information can only be shared if the department takes measures to mitigate the risk of mistreatment such that the residual risk is no longer substantial. Much therefore depends on who, within departments, is authorized to make decisions regarding whether:

  • an instance of proposed information sharing would result in a substantial risk of mistreatment; and
  • the proposed mitigation measures are sufficient.

In looking at the various decision-making processes adopted by departments, NSIRA noted varying levels of independence from operational personnel. Of particular interest were processes where the individual making decisions has a direct operational interest in the sharing of the information, creating the potential for conflict between operational imperatives and departmental obligations to respect the MD.

At CSE, the complete Mistreatment Risk Assessment process is conducted by non-operational units. The centralization of information sharing decision-making in a single branch minimizes direct operational pressure while facilitating informed and objective decisions.

The RCMP process uses other mechanisms to ensure independent decision- making. Individual investigators, when they wish to share information, must consult a list of countries and types of information sharing that the RCMP has pre-determined as representing sufficient risk of mistreatment. If the proposed sharing matches the list, then the case is automatically referred to the Foreign Information Risk Advisory Committee (FIRAC). FIRAC comprises a range of senior officials from RCMP headquarters who are a step removed from the operational front-line. The RCMP’s system of referral to FIRAC based on clear criteria removes discretion from officers with a vested interest in the sharing of the information. These officers may not have a full understanding of the geopolitical context of the proposed information sharing and thus are not best-placed to assess whether a substantial risk of mistreatment would result.

GAC requests that Directors General and Heads of Mission refer all cases where proposed information sharing “presents the potential for substantial risk of mistreatment” to the MDCC. The decision as to whether the substantial risk can be mitigated is made centrally by the MDCC, which comprises senior officials from across the department as well as a legal representative. As noted above, however, GAC currently does not provide officials with guidance on how to determine whether the threshold for referral to the MDCC has been met.

Compared to CSE, GAC, and the RCMP, decision-making at CSIS and DND/CAF is much closer to operations. CSIS provides high-level guidance to desks on how to identify information sharing that may result in a substantial risk of mistreatment, but leaves final decision-making regarding whether the situation does in fact create a substantial risk, and whether the risk can be mitigated, to the Deputy Director General or the Director General of each branch. Only if CSIS has heavily restricted information sharing with the foreign entity in question – or else the branch is unsure whether the substantial risk can be mitigated – then the branch must refer the case to the Information Sharing Evaluation Committee (ISEC) for determination. As a result, most of CSIS’s information sharing decisions – even those involving a substantial risk of mistreatment – are made by officials with a direct operational stake in the outcome of the proposed information sharing.

Within DND/CAF, decisions regarding the sharing of information rest with officers within the military chain of command. NSIRA was informed that while routine information sharing is approved by designated lower-level officers in theatre, cases involving unusual circumstances, or where there is uncertainty as to whether a substantial risk of mistreatment exists or can be mitigated, are elevated to senior levels. Once passed up the chain of command, senior officers receive advice from a range of officials at headquarters.

CBSA, at the present time, does not have processes to assess substantial risk or to make decisions regarding whether such risks can be mitigated. In practice, therefore, the onus currently rests on CBSA officers, acting without guidance, to identify cases that invoke the 2017 MD and to manage the associated risks. CBSA has drafted a procedure for cases where there is uncertainty as to whether a substantial risk of mistreatment can be mitigated, but it has not yet been implemented.

Recommendation no. 2: Departments should ensure that in cases where the risk of mistreatment approaches the threshold of “substantial”, decisions are made independently of operational personnel directly invested in the outcome.

Country Assessments

As noted above, a significant addition to the 2017 MD was the requirement that departments maintain policies and procedures to assess the risks of their information sharing relationships with foreign entities. Notably, the MD required departments to assess the human rights records of foreign countries generally and not just of specific foreign entities (i.e., police or intelligence services) within those countries. While the MD did not prohibit information sharing with foreign entities in countries with troubling human rights records, it implied that Canada’s relationships with such foreign entities could not be considered in isolation from the broader human rights environment in which these entities functioned.

In several instances, NSIRA noticed departments citing an absence of direct Government of Canada intelligence of mistreatment by a specific foreign entity in support of a proposed sharing of information, or else in support of a less restrictive information sharing policy towards the entity in question – despite ample reporting of systemic human rights abuses in the public domain. NSIRA observes that a lack of internal Government of Canada reporting of mistreatment by a specific foreign entity is not evidence that the entity does not engage in mistreatment. Departments must consider the full range of sources in assessing risk, including open sources such as the media and non-governmental organizations.

GAC, CSIS, CSE, and the RCMP all maintain their own sets of foreign country and/or entity profiles, while DND/CAF is currently developing its own as well. The existence of multiple different assessments is duplicative and unnecessary. and It may also yield significant inconsistencies, as departments have at times come to quite different conclusions about foreign countries’ and entities’ human rights records and the associated risks of information sharing. With the issuance of direction under the ACMFEA to twelve departments, this issue will likely grow. See Annex F for additional discussion of this point.

The ISCG seeks to guide departments in developing their human rights assessment processes by providing a forum to discuss best practices. PS informed NSIRA that the ISCG had not discussed plans to standardize these assessments.

Recommendation no. 3: Departments should develop:

  • a unified set of assessments of the human rights situations in foreign countries including a standardized ‘risk of mistreatment’ classification level for each country; and
  • to the extent that multiple departments deal with the same foreign entities in a given country, standardized assessments of the risk of mistreatment of sharing information with foreign entities.

The recommendation above does not preclude department-specific approaches to mitigating the risks of mistreatment. For instance, a department may be able to draw upon aspects of its relationship with a foreign entity to reduce the risk of mistreatment not available to other departments. These differences should not affect the initial determination of the underlying risk of mistreatment posed by information sharing with a foreign entity, however.

In India v. Badesha (2017), the Supreme Court of Canada recently provided guidance on contextual factors to be considered when assessing the reliability of assurances sought from foreign entities regarding mistreatment. Though not exhaustive, the decision provides departments with some guidance regarding the adequacy of assurances received.

Duty of Care

In reviewing GAC, NSIRA noted a tension between adherence to the 2017 MD and GAC’s duty of care with regard to the safety and security of mission staff abroad. Indeed, both cases of information sharing referred to the MDCC in 2019 involved threats to mission In one of the cases, information was shared with a foreign entity before the MDCC had had the chance to assess the risk of mistreatment. In this instance, the GAC official cited the need to protect the safety of mission staff (see Annex H).

NSIRA acknowledges the importance of mission security and the seriousness of the conundrums that can arise when the needs of mission security and GAC’s obligations with respect to information sharing collide. Yet the charged atmosphere of a mission under threat may not be the best venue for quick decision-making involving risks of mistreatment.

Substantial Risk

Like the 2017 MD, the ACMFEA and its associated direction prohibit information sharing that would result in a substantial risk of mistreatment. Neither the ACMFEA nor its direction include a definition of “substantial risk”, however, despite the centrality of this concept to the regime. A definition of substantial risk existed in both the 2011 and 2017 MD; its absence now raises concerns about its interpretation in the future.

In consultation with other departments, PS is developing a policy document that includes the same definition of substantial risk that was found in the 2011 and 2017 MD. The document also contains guidance on other requirements contained in the 2017 MD but that were omitted from the ACMFEA and its direction. When asked by NSIRA, the six departments that had been subject to the 2017 MD all stated that they intended to continue abiding by the established definition of substantial risk. This is reassuring, and should limit the potential for inconsistency between departments. Nonetheless, such a crucial definition should not be left up to individual departments to determine.

Recommendation no. 4: The definition of “substantial risk” should be codified in law or public direction.

The definition of substantial risk in the 2017 MD requires that mistreatment be “foreseeable”. As described in Annex G, DND/CAF’s assessment of foreseeability encompasses a number of factors, but a key component is that the risk of mistreatment be a “causal consequence” of DND/CAF information sharing. NSIRA observes that DND/CAF’s interpretation of foreseeability runs the risk of narrowing the definition of substantial risk and therefore the application of the 2017 MD. Given the importance of a clear and consistent understanding of “substantial risk” across departments, in future years NSIRA may review the application of the “substantial risk” threshold by DND/CAF – and other departments – to information sharing with foreign entities.

A substantial risk of mistreatment is defined as existing in cases where mistreatment is more likely than not. The definition includes a qualifier, however, that the threshold may be met at lower level of probability “where the risk is of severe harm”. This reflects a larger point that the assessment of substantial risk is not intended to be a narrowly mechanistic process of balancing probabilities. The 2017 MD notes that the Government of Canada “has no interest in actions associated with the use of torture or other cruel, inhumane or degrading treatment or punishment. Knowingly associating the Government of Canada with any of these actions would damage the credibility and effectiveness of any department or agency associated with them”. When interpreting the threshold of substantial risk, departments should always bear in mind the larger purpose of Canada’s framework for sharing information with foreign entities.

In order to give life to this framework, it is incumbent on departments, first, to ensure that their employees are trained to the point where they fully understand their legal obligations, and second, to establish clear and well-developed processes that foster and facilitate compliance in the broadest sense.

6. Conclusion

This review set out to build NSIRA’s knowledge of the information sharing processes adopted by departments under the 2017 MD. NSIRA noted significant differences between the six departments reviewed with respect to the level of implementation of information sharing processes. Processes also varied widely in terms of the level of independence of decision-making.

Although departmental information sharing frameworks will continue to evolve over time, this review will provide a baseline of comparison for future developments under the ACMFEA. The review also served to identify areas of potential concern that NSIRA may revisit in future years.

Share this page
Date Modified:

Review of CSIS threat reduction activities

Review Backgrounder

On February 15, 2021, the National Security and Intelligence Review Agency (NSIRA) presented the Minister of Public Safety and Emergency Preparedness with a classified report on its review of CSIS threat reduction activities. This was NSIRA’s first review of CSIS’s threat reduction mandate. The report contains a detailed compliance review of a sample of TRMs from 2019.

NSIRA’s review found that all of the measures reviewed met the obligations under Ministerial Direction. For the most part, the measures taken by CSIS also satisfied the requirements of the CSIS Act. NSIRA also noted, however, that in a limited number of cases, CSIS selected individuals for inclusion in the TRM without a rational link between the selection of the individual and the threat. As a result, these measures were not “reasonable and proportional” as required under the CSIS Act.

For one type of TRM reviewed, NSIRA is of the view that more consideration needs to be given to the way in which CSIS engages third parties. This would require CSIS to consider fully the Canadian Charter of Rights and Freedoms (Charter) implications of its measures, and could require CSIS to obtain warrants before taking certain measures.

As 2020 marked five years since CSIS obtained threat reductions powers as part of the Anti-terrorism Act, 2015, NSIRA conducted high-level analysis of all TRM activities over the past five years to identify trends and to inform NSIRA’s choice of future review topics. Overall, NSIRA noted that while CSIS’s use of TRM powers has not been extensive, CSIS has been applying TRM powers to the full spectrum of national security threats mandated under the CSIS Act.

Publishing this summary aligns with NSIRA’s efforts at increasing transparency and being more accessible to Canadians through its work. Going forward, NSIRA will continue to examine CSIS’s threat reduction activities annually as required by section 8(2) of the NSIRA Act.

Table of Contents

Date of Publishing:

Share this page
Date Modified:

Review of the CSIS-RCMP relationship in a region of Canada through the lens of an ongoing investigation

Review Backgrounder

On February 10, 2021, the National Security and Intelligence Review Agency (NSIRA) presented the Minister of Public Safety and Emergency Preparedness with a classified report on its review of the CSIS-RCMP relationship in a region of Canada through the lens of an ongoing investigation.

NSIRA’s review found that in the specific region, the agencies have developed a strong relationship that has fostered effective tactical de-confliction of operational activities. Nonetheless, technological constraints are making CSIS-RCMP de-confliction excessively burdensome and time-consuming. Furthermore, NSIRA observed a general reluctance on the part of both agencies to connect CSIS information to an RCMP investigation.

NSIRA found that the current framework guiding the CSIS-RCMP relationship sets out principals and guidelines to manage the risks of interaction and information sharing between the two agencies; however, it left fundamental issues related to the “intelligence-to-evidence” problem unresolved.

On the whole, NSIRA found that CSIS and the RCMP have made little progress in addressing the threat under investigation. Moreover, CSIS and the RCMP do not have a shared vision or complementary strategy to address the threat.

Publishing this summary aligns with NSIRA’s efforts at increasing transparency and being more accessible to Canadians through its work. Going forward, NSIRA will review CSIS and the RCMP’s implementation of the Operational Improvement Review which set out ambitious recommendations to improve the way in which CSIS and the RCMP jointly manage threats.

Table of Contents

Date of Publishing:

Share this page
Date Modified:

Review of the Canadian Security Intelligence Service’s (CSIS) Internal Security Branch

Review Backgrounder

On August 14, 2019, the National Security and Intelligence Review Agency (NSIRA) presented the Minister of Public Safety and Emergency Preparedness with a classified report on its review of the Canadian Security Intelligence Service’s (CSIS) Internal Security Branch. This review is a follow-up to the 2013 study conducted by NSIRA’s predecessor, the Security Intelligence Review Committee (SIRC) of CSIS’s Internal Security (IS) Branch. SIRC found a number of serious shortcomings related to CSIS’s handling of sensitive case files, access lists and their practices and management of internal investigations.

NSIRA’s latest review found that while significant improvements have been made with respect to internal security at CSIS since the 2013 review (The “Insider Threat” and Its Effect on Information Management — Section 54 Report (TOP SECRET) (PDF of Review) (SIRC 2013-06)), further improvements to internal security policies could strengthen the consistency of decision-making on personnel security files and investigations. It could also improve the procedural fairness of these processes writ large.

NSIRA’s review also examined the use of the polygraph, and sought justification for its use and the extent to which such determinations are reasonable and necessary. Several key observations were derived from this analysis. It also raised a much broader consideration: namely, the extent to which the government’s overarching policy document, the Standard on Security Screening, provides adequate guidance for departments and agencies when they implement this safeguarding measure.

Going forward, NSIRA will continue to examine the Government’s use of the polygraph as a security screening tool.

Table of Contents

Date of Publishing:

Share this page
Date Modified:

Review of the Canadian Security Intelligence Service’s (CSIS) use of Geolocation information

Review Backgrounder

On August 23rd, 2019, the National Security and Intelligence Review Agency (NSIRA) presented the Minister of Public Safety and Emergency Preparedness with a classified report on its review of CSIS’s use of geolocation information.

In this review, NSIRA found that CSIS’s use of this geolocation data without a warrant risked breaching section 8 of the Canadian Charter of Rights and Freedoms (Charter), which protects against unreasonable search and seizure. On March 16, 2020, NSIRA submitted a report under section 35 of the NSIRA Act, to the Minister of Public Safety regarding the possible unlawful activity.

This review raised pressing questions regarding the use of publically available data, but that nevertheless engages a person’s reasonable expectation of privacy. NSIRA’s review examined the decision-making process that led CSIS to use this data without a warrant, and found that CSIS lacked the policies or procedures to ensure that, prior to using the data, CSIS sought legal advice to avoid its unlawful use.

The review was also an opportunity to note more broadly that, in this environment, ongoing legal support to CSIS’s data exploitation activities is essential in allowing CSIS to operate at an acceptable level of risk. It also noted that CSIS and the Department of Justice are expected to demonstrate institutional leadership in this regard.

Going forward, NSIRA will prioritize the scrutiny of CSIS’s use of technology, particularly new or emerging technologies that pose the greatest risks.

Date of Publishing:

1. Authorities

This review began under the authority of the Security Intelligence Review Committee (SIRC) articulated in subsection 38(1 ) of the Canadian Security Intelligence Service’s (CSIS Act), which provided SIRC the mandate to review CSIS’s operations in the performance of its duties and functions.

During the course of the review. Bill C-59 -An Act Respecting National Security Matters received Royal Assent on June 21, 2019. Part 1 of Bill C-59 enacted the National Security and Intelligence Review Agency Act (NSIRA Act), which came into force by order of the Governor in Council on July 12, 2019. The NSIRA Act repeals the provisions of the CSIS Act that established and governed SIRC and establishes in its place the National Security and Intelligence Review Agency (NSIRA). The NSIRA Act sets out the composition, mandate and powers of NSIRA and amends the CSIS Act, and other Acts, in order to transfer certain powers, duties and functions to NSIRA.

This review continued under the authority described in subsections 8(1 )(a) and 8(3) of the NSIRA Act to review any activity carried out by CSIS and to make any finding and recommendation that NSIRA considers appropriate.

2. Introduction

In its review function, NSIRA expects CSIS’s activities to be lawful and comply with ministerial direction. This review focused on CSIS’ s non-warranted collection of geolocation information and is part of NSIRA’s ongoing interest in CSIS’s collection and exploitation of both warranted and unwarranted data. Past reviews have assessed CSIS’s warranted collection and retention of metadata and CSIS’s unwarranted collection and exploitation of bulk personal datasets. This is NSIRA’s first dedicated look at CSIS’s collection of geolocation data.

The review takes place in the context of Federal Court decisions, most particularly the IMSI decision of September 27. 2017, that impact on CSIS’s collection, use and retention of data, including geolocation data. The IMSI decision found that, though CSIS’s authority under section 12 does authorize it to obtain geolocation information for which there is a low expectation of privacy, anything beyond that, such as geolocating an individual, would require a warrant.

It is worth noting that the scope of the review was broader at the outset and was intended to include a more comprehensive examination of the collection of different types of geolocation information, both warranted and unwarranted. Although the scope was reduced in the course of the review, NSIRA will be mindful of this for future reviews.

3. Objectives

The objective of this review is to assess whether CSIS’s collection of unwarranted geolocation information used by CSIS in support of its operations is compliant with applicable sources of law, including the Canadian Charter of Rights and Freedoms (Charter) and the CSIS Act, as well as ministerial direction and operational policy. A related objective is to determine whether CSIS has sufficient safeguards in the form of formal procedures and policies to ensure that it is able to comply with its legal obligations amid a period of rapid change in technology and a correspondingly fluid legal environment.

4. Scope and Methodology

The scope and direction of the review was identified through a preliminary investigation of available documentation and a briefing with the ████████████████████████████████████████████████████████ Further, NSIRA requested that CSIS identify all activities undertaken by the █████ that may result in geographic information collected against non-warranted targets within the review period. This information was used as a foundation to
request specific documents from CSIS.

NSIRA examined all documents provided by CSIS and sought, retrieved and reviewed documents through CSIS’s various computer and email systems to ensure a clear record of activity. Documents reviewed included: ██████████████ taskings from the regions, responses to these taskings, briefing notes, planning documents, legal assessments and internal correspondence.

To conduct a compliance assessment of CSIS’ s use of geolocation information, NSIRA chose to conduct an in-depth case study of ██████████████████████████████████████████ geolocation information. NSIRA reviewed all instances when ██████████ was used by CSIS during the period under review. As this review consists of a single case study. NSIRA is mindful of generalizing the findings and conclusions to other types of geolocation data.

The core review period for this study was from January 1, 2017 to June 30, 2018, although NSIRA examined documentation that fell outside this period in order to provide a complete assessment of relevant issues.

5. Criteria

NSIRA expects CSIS to conduct its activities in accordance with relevant sources of law. including the CSIS Act. the Charter. the Privacy Act. and case law. NSIRA also expects CSIS to conduct its activities in accordance with ministerial direction. Most relevant in this review given the subject matter was an analysis of the Charter, which, in section 8, provides everyone with the right to be secure against unreasonable search and seizure.
In this case, at issue was whether the use of ███████ to collect information about an individual’s location information constitutes a search for the purposes of section 8 such that a warrant would be required.

Policies and Procedures

NSIRA’s expectation was that there would be policies and procedures in place to guide the collection, use and retention of data from ███████ despite its uniqueness, and that those policies and procedures would support compliance with CSIS’s legal obligations, including the Charter, as well as its obligations stemming from ministerial direction.

For reference, the relevant policies that pertain to the collection of information ███████

  • ███████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ In principle, this allows collection of this nature on a very broad cross-section of individuals;
  • The collection of █████████ policies, including the DDO Memorandum of 2015 that request the establishment of █████████ as the National Policy Centre for █████████. Additionally there is the procedure on █████████ that allows █████ to conduct █████████ defined as a non-warranted collection tool or technique, against a ██████████████████████████████████████████████████████████████.

6. Background

The Investigative Technique – █████████

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ from users across the world.

█████████ contains three months of data. The information is not available in real-time; however, there is a delay of only 24-48 hours between the collection of the ████ and it becoming available in ████████.

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

See Annex A for an example of the use of █████ against a CSIS target.

A chronology of CSIS’s use of █████

a. From introduction to the beginning of the pilot: July 2015 – January 2018

████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

█████ echoed those same governance-related issues; specifically, it questioned whether there were legal issues associated with █████ that needed to be addressed prior to the trial period. █████ asked for “the rules of engagement so that we can plan accordingly and get the most of this evaluation.”█████ further noted that, although the data seemed “wonderful….there must be some legal/governance rules that apply to this when in the hands of a government agency. These questions were raised in an email to both █████ and the ██████████

███████████████████████████████████████████████████████████████████████████████████████████████████████████████████ Nevertheless, by September 2017 █████ was anticipating an evaluation of █████ that would involve using █████ for a trial period of two months with a limited ██████████.

█████convened a meeting in October with █████████████████████████████████████████████████████████████████████████████████████████████████████████ The objective of the meeting was to prepare for a █████ evaluation and, for that purpose, “to make decisions on a few details to ensure compliance with
legal and policy.

The questions to be covered in the agenda were:

  • 1 ) Does existing █████ policy cover the use of █████ or does the policy need to be adapted?
  • 2) Is the information contained in ███████ subject to a reasonable expectation of privacy?
  • 3) Is there anything else that needs to be considered before CSIS can use █████? For example, additional █████ procedures or tests?

According to a written summary of discussions circulated by █████ following the meeting, it was agreed that ███████ would be compliant with collection under the ████████████ which allows ████ to “research and use open information” in support of investigations, it was further decided that the use of ██████ would align with ████ policies as it would constitute threat related queries ██████████████ and would be used only with the ██████████ authorities in place. Finally, it was assessed that the ██████ data invested would meet the “strictly necessary” threshold for collection and retention as set out in the CSIS Act as it would be based on a specific threat.

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

Following the meeting, approval was granted for the trial use of ██████ by Deputy Chief █████████. Documentation of the approval consists of an email from the Deputy Chief to ███ and ███ with the understanding that, ██████████████████████████████████████████████████████████████████.

b. CSIS’s trial period – March 2018 – July 2018

CSIS began its pilot of ████ on January 14. 2018. It was initially to be for two months; but because of technical issues at the beginning that delayed its full use, and due to ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

During that time, ████████ was tasked a total of approximately ████ times, resulting in ████ operational messages. As noted, efforts were made by ███ to ensure that its use of ████████ was compliant with CSIS’s ████ policies on collection ████████████████████ as well as the CSIS Act provision that collection and retention be done only to the extent that is “strictly necessary.”

████ completed its evaluation of ████ by the end of April 2018. ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████.

The first version of a briefing note to gain approval for the ████████████ was drafted jointly by ████ and ███ in April 2018. The briefing note stated that the pilot for ████ was “conducted operational policies.” The briefing note also ████████████████████ one was a restricted amount of information that would meet the strictly necessary threshold; and the other was a situation in which ████████████████████ in which case it would be ████████████████████████████.

A subsequent version of the briefing note was prepared, also jointly by ████████████. This one was dated May 15, 2018 and was sent to the Director General of ████. In contrast to the first version of the briefing note, this one was the dual purpose of obtaining a legal opinion and ████████████████. This version was ultimately sent to the DG ████████ and also included that ████████ had been assessed as compliant with ████ authorities, following discussion with CSIS’s External Review and Compliance (ERC). ████ as well as informally with a representatives of the DLS. The briefing note stated that ████████████████████████ fall within existing authorities and directives” and, further that “although ████ has assessed that ████████████████ a formal legal opinion has not yet been conducted and suggest this briefing note be used as a mechanism to obtain one.”

NSIRA inquired as to the substance of the ERC and DLS discussion, as well as documentation of those meetings. NSIRA was advised that the ERC compliance officer embedded within ████ was aware of ████ which was presented at a town hall, but that it was not discussed with her beyond that. NSIRA asked for documentation to substantiate the DLS discussions but non was provided.

c. Legal advice: July 2018 – February 2019

Following the May briefing note, on July 20th, the DG ██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

By July 31, preliminary legal advice was received:

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

A formal legal opinion was provided on December 7, 2018, that called into question CSIS’s use of ████████ without a warrant except in very narrow circumstances, ████████████████████████████████████████████████████████████████████.

A further legal opinion was requested by CSIS to determine whether ████████████████████████████████████████. The resulting legal opinion, dated February 19 2019, ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████. Accordingly, section 8 of the CHarter would not be engaed in this narrow circumstance.

based in part on the February 2019 legal opinion, CSIS subsequently took the decision to ████████████████████████████████████████████████████████████████████████████████████████████████████████. It is NSIRA’s understanding that, presently, ████████████ being used only in very specific circumstances and according to the guidelines set out in the legal opinions.

7. Findings

Finding no. 1 Compliance with the CSIS Act and the Charter NSIRA finds that there was a risk that CSIS breached section 8 of the Charter during the trial period in which it used █████ without a warrant.

DLS was asked to provide a legal opinion to CSIS on this investigative technique; in particular, to address the question of the “legal risk of using ██████████ (i) with respect to Canadians or persons in Canada; and (ii) human sources and employees, with their informed consent”. CSIS was advised in a Legal Memorandum dated December 7,2018 that:

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

NSIRA’s own review of the file, which is meant to provide the Committee with independent legal advice, supports DLS’s opinion in that regard. In particular, NSIRA believes that the use of ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████. NSIRA observes that it is very unlikely that a court would find that section 12 of CSIS Act was sufficient legal authority to render warrantless use of ██████ reasonable” for the purposes of section 8 of the Charter. Accordingly, CSIS would be required to obtain a warrant pursuant to section 21 of the CSIS Act for such searches. Of note, NSIRA’s legal analysis was based on the same set of facts as DLS used for its opinion.

In reaching this conclusion. NSIRA interprets section 12 of the CSIS Act as only providing authority for collection activities of minimal intrusiveness. In that regard, NSIRA concurs with the DLS opinion that, ██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

At the time of writing, CSIS is pursuing options for how █████████ may be used under the authority of a warrant in the future.

NSIRA recommends that CSIS review its use of █████████ to date and make a determination as to which of the operational reports generated through the use of ███████ were in breach of section 8 of the Charter. These operational reports and/or any documents related to those results should be purged from its systems.

Findings no. 2 Governance related to piloting █████████

NSIRA finds that there was no policy centre clearly responsible for the use of the data contained in ████████.

NSIRA asked about the policies and procedures that guided the decision to authorize the trial period, as well as which unit within the ██████████████████ branch would have been responsible for assessing and authorizing the use of ███████ As described above, the record suggests there were three discrete units involved in the ████████████████████████ for the trial period.

█████████████ was involved in the ██████████████████ As the policy centre with respect to the ███████████████████████████████ the role and mandate of ████ is to coordinate, manage and █████████████████████████████████. In this capacity, ████ would have been responsible for assessing ████████ for privacy impacts, among other things, had ████████ been assessed as a ████████. However, ████████ was not ████████████████ but rather, as ████████████████████████████████████████████████████████████████. Therefore, █████ did not officially assess ███████████████████████████████████████. That said, the briefing note of May 15 2018, clearly indicates that ██████ assessed that the use of ████████████ fall within existing authorities and directives.” Given the lack of a formal record, NSIRA was unable to assess the content of, or the rationale for, this assessment.

██████ is the unit responsible for providing operational support for ████████████████████████ intelligence through the use of covert ████████████████████████████████████████████████████████████████████████████████████ and it was to ████ that the first demonstration of ██████ was given, ███ authorities were eventually identified as those under which ██████ would operate. However ██████ was not the primary user of ██████. Neither did it participate in the formal evaluation of the data contained in ████████████.

Responsibility for developing a means of formally evaluating ██████ fell to the ██████ given its expertise in geolocation information. However, ████ does not generally collect data, but is merely the user of data provided to it. As such, █████ thorough preliminary evaluation to determine whether there were legal or other issues that needed to be addressed, even at the pilot stage. Nevertheless, ████ prepared, on its own initiative, a formal document to guide its evaluation of ██████ during the trial period. NSIRA also notes that ████ followed existing policy in using ███████ only in instances when a valid targeting authority was in place.

NSIRA was not provided any formal documentation on the decision to authorize the pilot period. The record of decision to pilot ██████ consisted of an email, which contained the following:

I don’t see any reason not to start an evaluation – ████████████████████████████████████████████████ In addition, ████████████████████████ are not provided until after we can determine that they are “strictly necessary” and of relevance to the investigation -just until we find something of relevance.

Ultimately, NSIRA was unable to identify which of the three policy areas within ██████ should have had, according to existing policies and procedures, responsibility for the assessment of ████████████████████████████████████████████████████████████████████████████████████.

Finding no. 3 Record of decision

NSIRA finds that the record of approval to pilot ██████ consisted of an email and that this email was not “put-away” as part of the official record, as it should have been.

As noted, the closest thing to a record of decision to pilot ██████ was an email from a Deputy Chief of ██████ the full text of which is cited above.

NSIRA notes that this email was not “put-away” as is should have been given that it represents, de facto, the approval for acquiring ██████ for the purposes of evaluation and is required for robust records management and for accountability purposes. Instead, it was saved on a “personal” drive and only produced as part of the review process.

Findings no. 4-5 Assessment of risk in the case of ██████

NSIRA finds that there are no developed policies or procedures around the assessment and handling of new and emerging collection technologies, such that a formal evaluation of the legal risks of using ██████ would have been required.

NSIRA finds that CSIS overlooked multiple indicators that using ██████ might raise legal issues.

Ministerial Direction requires that the risk of operational activities be assessed across four pillars (operational, political, foreign policy and legal ). In particular, the Direction states that CSIS should “consider its ow n level of experience and novelty of the operational activity in assessing risk”.

NSIRA was told that there is no formal process for the evaluation of risk in cases like ████████████ given that it was assessed as ████████████████████████. This is consistent with NSIRA’s reading of the relevant policies, cited earlier, pertaining to ██████████████████████████████████████████ of which require an assessment of legal risk prior to the use of ████████████ for collection purposes.

██████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

It was suggested to NSIRA that it would not have been possible to conduct a thorough assessment of ████████ before the pilot based on the reasoning that a risk assessment is only possible with full ████████. NSIRA accepts in principle that there are situations when it would be difficult to appreciate the legal risks until such time ████████████████ and fully evaluated. Notwithstanding the difficulties, it is the responsibility of CSIS to mitigate these risks to the extent possible.

In this case, moreover. NSIRA notes that there were indications of a need for caution with respect to the ████████ in the period before the trial was even begun, including the IMSI decision of the Federal Court, which found that geolocating an individual would require a warrant.

Internally, there were multiple indications to the effect that there may be reason for particular attention, including:

two emails sent prior to the pilot, one by █████ on June 28. 2017. and the other by █████ September 27. 2017, both containing legal and governance questions;

the meeting convened by █████ for the purpose of discussing whether there existed a reasonable expectation of privacy in the █████ data;

the examples provided by ███████████████████████████████████████████████████████████████████████████████████████████████ and the evaluation of █████ in April 2018. which indicated that there were privacy concerns with this tool given its ability to generate ███████████████ and to ██████████████████████████████████████████████████████████████████████

There were other indications of a need for caution, ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████

Despite these signs, no formal action was taken to assess the question of legal risk until the briefing note in May 2018 requested a formal legal opinion.

NSIRA recommends that policy be developed or amended as appropriate that would require a documented risk assessment, including legal risks, in situations like ██████████ when information collected through new and emerging technologies may contain information in respect of which there may be a reasonable expectation of privacy. If not █████ NSIRA further recommends that a policy centre for this type of █████ collection be clearlv identified.

Conclusion

At the outset █████ was characterized as making use of ██████████. This is made clear from the approval email, ████████████████████████████████████████████████████████████████████████████████████████████████████████████████████████ would consider, it is not clear that the data exploited through ██████████ represents genuinely ██████████ at least as defined in plain language, as was asserted.

Assessing █████ in this way was not without its consequences in that it appears to have justified the lack of a more thorough legal assessment. This assumption proved to be problematic; the consequence was that CSIS placed itself at risk of having violated the Charter. Throughout this review. NSIRA has been mindful of the length of time it took for CSIS to obtain the final legal opinion, which was requested in July but finalized only in December, a full five months later.

NSIRA is aware that there have been discussions within ██████████ on the need to have ongoing legal support. In particular █████ has requested the establishment of a policy and legal operating envelope to ensure that policy and legal questions related to data exploitation are properly covered, including a resource from DLS who would provide ongoing, even weekly, legal assistance. NSIRA understands that this request was made in part due to the difficulties associated with obtaining legal advice on an as needed basis. NSIRA has been advised that █████ request to have weekly legal support has not yet been actioned.

The combination of an expanding scope in the type, volume and sources of data collected by CSIS and a fluid legal situation makes this an area of persistent high legal risk. CSIS has publicly affirmed that the concept of a reasonable expectation of privacy is evolving over time and committed to ensuring that CSIS’s approach to a reasonable expectation of privacy “is kept consistent”.

NSIRA is of the view that, in this environment, legal support to █████ is essential to operate at an acceptable level of risk. NSIRA expects CSIS and the Department of Justice ( DOJ) to demonstrate institutional leadership that would allow responsible decision-making in an environment of uncertainty by making available legal support to █████ as required on a priority basis.

Share this page
Date Modified:

Review of the Communications Security Establishment’s Disclosures of Canadian Identifying Information – CSE responses

Responses

Review of the Communications Security Establishment’s Disclosures of Canadian Identifying Information – CSE responses


CSE Management Response to NSIRA Review of 2018-2019 Disclosures of Canadian Identifying Information

NSIRA delivered its classified review to the Minister of National Defence in November 2020.

Throughout NSIRA’s review of CSE’s disclosure process, CSE responded to NSIRA requests in a timely manner and offered to provide additional context and briefings to NSIRA regarding CSE processes.

Importance of independent external review

CSE values independent, external review of our activities, and we remain committed to a positive and ongoing dialogue with NSIRA and other review and oversight bodies.

This oversight frameworks allows us to deliver our important mission of foreign intelligence, cyber security and foreign cyber operations in a way that demonstrates accountability, and that builds trust and confidence with Canadians.

CSE operates within a culture of compliance, grounded in our understanding of and commitment to our legal and policy regime, and evidenced by our record of self-reporting and addressing incidents and errors that may occur.

We appreciate NSIRA and their continued work to provide Canadians with greater insight and understanding of the important work that CSE does on a regular basis to keep Canadians safe.

We accept the recommendations aimed at improving our processes, yet are concerned that the overall conclusions do not fully appreciate CSE’s commitment to, and work on protection of privacy.

Canadian Identifying Information and CSE’s Commitment to Privacy

CSE is Canada’s national lead for foreign signals intelligence and cyber operations, and the national technical authority for cybersecurity. We provide critical foreign intelligence and cyber defence services for the Government of Canada (GC). Protecting Canadian information and the privacy of Canadians is an essential part of our mission.

CSE does not direct its foreign signals intelligence activities at Canadians or anyone in Canada. The CSE Act, however, recognizes that incidental collection of Canadian communications or Canadian information may occur even when targeting only foreign entities outside Canada. CSE takes very seriously our responsibility to protect Canadian privacy interests that may occur as a result of this incidental collection.

In the event that Canadian information is incidentally acquired in foreign signals intelligence collection, CSE may include obfuscated references to Canadian individuals or organizations in intelligence reporting if those references are essential to understand the foreign intelligence.

The obfuscation of this Canadian Identifying Information (CII) in reporting represents one of many layered privacy measures that are applied at different points in CSE’s end-to-end intelligence process. These include, among others, legal and policy training and on-site support for intelligence analysts, mandatory annual privacy tests for all operational employees, data tagging and auto-deletion, strict retention limits, specific handling guidelines, escalating approvals for reporting that includes CII, compliance spot checks, and separate vetting processes for disclosing obfuscated information and taking action on intelligence reporting.

Pursuant to the Privacy Act, government clients who receive CSE foreign intelligence reports may ask for obfuscated CII to be “disclosed” to them if that information relates directly to their department’s operating program or activities. Any disclosed CII is provided solely to inform their understanding of the foreign intelligence presented in the report. Government officials may not take action, share or otherwise use the CII disclosed to them under the disclosure process.

CSE continually refines its CII disclosure process. For example, to help support audit and review, CSE implemented a requirement for government clients to provide an operational justification to support their CII disclosure requests. It is important to note, however, that this is a matter of internal policy and that the Privacy Act does not require the documentation of legal authorities before information can be collected and disclosed.

Review Recommendations

CSE is committed to continuous improvement. We know that the recommendations from independent external review play an important role in that improvement. CSE has 25 years of experience working with the Office of the CSE Commissioner and now NSIRA to help improve our processes. We thank these review bodies for their work to help build trust and confidence with Canadians.

CSE continuously refines our privacy-protection measures, including those associated with the disclosure process. Improvements made over the past decade have been informed by the recommendations made by the CSE Commissioner as part of his annual reviews of CSE’s CII disclosures. Prior to NSIRA taking over review duties, CSE had accepted and implemented 95% of the recommendations made by the CSE Commissioner. Those not adopted were duplicative or overtaken by events such as new legislation. In his final 2018-2019 review, the Commissioner confirmed that CSE’s disclosures of CII complied with the law and were done in accordance with ministerial direction.

In this NSIRA review, as with previous CSE Commissioner reviews, we appreciate and have accepted the recommendations aimed at improving our internal policies and practices.

Given the overlap in this review period between the two bodies, certain NSIRA recommendations duplicate some presented in the CSE Commissioner’s reviews. As a result, we are pleased to note that many have already been implemented at this time; other NSIRA recommendations are in the process of being implemented.

Review Findings

Throughout this CII disclosure review, CSE provided extensive feedback and context to NSIRA, and sought clarification regarding the assessment criteria used to determine adequacy or inadequacy of specific records, the vast majority of which were deemed adequate by NSIRA. Without explaining the methodology used to support the findings, we are concerned that broad generalizations based on specific aspects of certain records within a single privacy measure may leave the reader with an incorrect impression about CSE’s overall commitment to privacy protections for Canadians.

CSE’s case-by-case process for disclosing CII to authorized GC recipients is part of robust and comprehensive internal measures that protect Canadians’ privacy. We balance the sharing of our intelligence with the privacy and safety of Canadians at all times. CSE disclosure analysts receive training and follow internal policies, guidelines and standard operating procedures to guide decision making.

While committed to implementing the recommended process improvements contained in the report, CSE remains concerned by NSIRA’s overall conclusions and characterization of the disclosure process and its role in the broader privacy framework, which we have expressed to NSIRA.

Referral to Attorney General of Canada

The Minister of National Defence submitted NSIRA’s classified report to the Attorney General of Canada in January 2021, supported by a comprehensive analysis of each record identified by NSIRA in its review.

The analysis supports the view that our activities, including applying protections for the privacy of Canadians, were conducted within a robust system of accountability, including compliance with the Privacy Act.

Additional Information

Top Secret-cleared and special intelligence-indoctrinated GC clients received thousands of foreign intelligence reports via CSE’s mandate under the CSE Act. These reports corresponded to Cabinet-approved intelligence priorities and were delivered to government clients who had both the authority to receive them and the ‘need to know’ their contents.

These reports reflect a wide range of intelligence requirements, from support to Canadian military operations, espionage, terrorism and kidnappings to geostrategic concerns, cyber threats, foreign interference and global crises, among others. While only a very small percentage of these reports contain obfuscated CII, the underlying Canadian information is often essential for GC officials to understand the context of the threat and its Canadian nexus.

Share this page
Date Modified:

Review of the Communications Security Establishment’s Disclosures of Canadian Identifying Information

Context

On November 25, 2020, the National Security and Intelligence Review Agency (NSIRA) presented the Minister of National Defence and the Minister of Public Safety with a classified compliance report on its review of CSE’s disclosures of Canadian identifying information (CII). In this review, NSIRA found that the CII disclosure regime lacked rigour and that its implementation may not have been in compliance with the Privacy Act. Additionally, NSIRA found that the Federal Court may not have been adequately informed about key elements of CSE’s disclosures of CII collected on the authority of warrants issued in relation to section 16 of the Canadian Security Intelligence Service (CSIS) Act. Given the findings of the review, NSIRA has published its unclassified summary of the compliance report.

In carrying out its foreign intelligence mandate, CSE may incidentally acquire information about Canadians or person(s) in Canada. CII is information that could be used to identify an individual, and is normally suppressed from reporting unless Government of Canada or foreign clients request these details and are able to demonstrate that they have operational justification and legal authority to receive it.

After a thorough review of CSE’s disclosures of CII, which also involved direct engagement with other Government of Canada departments that request CII, NSIRA made 6 findings and 11 recommendations. This unclassified summary provides an overview of the CII disclosure regime, and NSIRA’s observations related to the policies, procedures, training, and the legal authorities governing it.

Publishing this summary aligns with NSIRA’s efforts at increasing transparency and being more accessible to Canadians through its work. Looking forward, NSIRA will conduct future reviews of the CII disclosure regime to ensure that its recommendations are implemented in a way that will improve the CII disclosure program and that this program is compliant with the applicable legal framework.

As per section 8(1)(a) of the NSIRA Act, independent review of CSE’s activities is a statutory requirement for NSIRA. As such, NSIRA will continue to review CSE activities and report on compliance issues if they arise.

To learn more about NSIRA’ mandate, click here.

Date of Publishing:

Executive Summary

Subsequent to the collection of foreign signals intelligence by the Communications Security Establishment (CSE), any incidentally collected Canadian identifying information (CII) is suppressed in CSE’s intelligence reporting to protect the privacy of Canadians and persons in Canada. However, the Government of Canada (GC) and foreign clients of such reports can request the details of this information if they have lawful authority and operational justification.

The National Security and Intelligence Review Agency (NSIRA) conducted a review of CSE’s disclosures of CII to GC clients. In reviewing disclosures containing 2,351 Canadian identifiers over a five year period, NSIRA found that 28% of requests from all clients were not sufficiently justified to warrant the release of CII. . Nevertheless, during the period under review, CSE approved 99% of these requests for CII from its domestic clients. Given this and other findings related to CSE’s internal practices, NSIRA found that CSE’s implementation of its CII disclosure regime may not be in compliance with the Privacy Act.

Moreover, NSIRA found that CSE has released CII to GC clients from its technical and operational assistance to the Canadian Security Intelligence Service (CSIS) in relation to section 16 of the CSIS Act, in a manner that was likely not communicated to the Federal Court by CSIS.

This report is a summary of the more detailed, classified report provided to the Minister of National Defence on November 25, 2020.

Introduction

The Communications Security Establishment (CSE) may incidentally acquire information about Canadians or persons in Canada in its collection of foreign signals intelligence (SIGINT). Canadian identifying information (CII) refers to any information that can identify an individual, ranging from names to email addresses and IP addresses. CII is suppressed in intelligence reports to protect the privacy of Canadians and persons in Canada. Government of Canada (GC) and foreign clients may subsequently request the details of this information if they have lawful authority and operational justification to collect it. This information sharing regime has been in place since the 2001 enactment of CSE’s powers under the National Defence Act, and has been previously reviewed by the Office of the CSE Commissioner (OCSEC)

Following a review of CSE’s disclosures of CII, the National Security and Intelligence Review Agency (NSIRA) concluded that CSE’s implementation of its disclosure regime may not be in compliance with the Privacy Act. Therefore, pursuant to subsection 35(1) of the NSIRA Act, NSIRA submitted a compliance report to the Minister of National Defence on November 25, 2020.

CSE’s disclosure regime, in place for nearly two decades, is one of the most important national security information sharing structures in the federal government, surpassing the volume of disclosures processed through the information sharing mechanism under the Security of Canada Information Disclosure Act (SCIDA). Unlike CSE’s disclosure regime, information sharing processes under SCIDA have recently undergone comprehensive scrutiny and debate both in Parliament and by the public as part of the deliberation of Bill C-59.

CSE’s work results in special responsibilities to protect the privacy of Canadians. In this context, NSIRA assessed CSE’s operational structures, policies, and processes to determine the rigour of the CII disclosure regime. NSIRA found serious problems with several aspects of the governance and implementation of CSE’s CII disclosure regime. NSIRA also found that CSE discloses information collected pursuant to the authority of Federal Court issued warrants as part of its assistance to the Canadian Security Intelligence Service (CSIS). NSIRA believes that although the Federal Court is aware of CSIS’ disclosure of CII, the Court may not have been fully informed about the parallel disclosure process taking place at CSE. In January 2021, CSIS provided the Federal Court with a copy of NSIRA’s full, classified review, excluding information protected by solicitor-client privilege.

Methodology

As part of its review, NSIRA examined a selected sample of CII disclosures and their associated intelligence reports – initially from July 1, 2018 to July 31, 2019, though the review period was later expanded to cover July 1, 2015 to July 31, 2019 for certain types of disclosures. Over that period, CSE received requests for 3,708 Canadian identifiers. NSIRA received information about the outcome of all of these requests. Additionally, NSIRA was able to closely review requests pertaining to 2,351 identifiers.

In all, NSIRA examined electronic records, correspondence, intelligence reports, legal opinions, policies, procedures, documents pertaining to judicial proceedings, Ministerial Authorizations, and Ministerial Directives of relevance to CSE’s CII disclosure regime. CSE also responded to NSIRA’s questions throughout the review.

While this began as a review of solely CSE, it became evident that NSIRA also needed to engage with CSE’s Government of Canada clients of CII. In the spirit of its legislation, NSIRA “followed the thread” by engaging with a range of federal departments, from recurring clients of CII, such as CSIS and the Royal Canadian Mounted Police (RCMP), to less frequent clients, such as Innovation Science and Economic Development Canada (ISED). Through this engagement, NSIRA was able to understand the lifecycle of CII disclosures, from their origin within intelligence reporting to their eventual use by Government of Canada clients.

NSIRA also assessed CSE’s disclosures of CII arising from its assistance to CSIS in relation to section 16 of the CSIS Act. When CSE assists CSIS in that context, it is bound by the applicable Federal Court warrants’ conditions. While CSIS’ disclosures were not the subject of this review, they helped contextualize the adherence of CSE’s section 16 CII disclosures with the conditions and principles on which the Court issued the relevant warrants.

NSIRA also reviewed CSIS affidavits to the Federal Court in relation to Canadian information acquired through section 16 warrants, which served as the basis for a recent decision issued on this program by the Court (reported as 2020 FC 697). Given this window into the parallel practices and policy requirements of CSIS, NSIRA had the opportunity to contextualize CSE’s disclosures of CII arising from section 16 collection in a way that was unprecedented for an external review body.

Based on the records provided by CSE, CSIS, and other federal government entities, NSIRA made several findings and recommendations to improve the governance of CSE’s CII disclosure regime and to bring to the attention of the Federal Court important aspects of CSE’s disclosures of information acquired in relation to section 16 of the CSIS Act.

For CSE to disclose Canadians’ personal information without their consent, both CSE and the CII recipient must comply with relevant legislation, which, for the period under review, consisted of the Privacy Act and the National Defence Act:

In assessing CSE’s disclosures, NSIRA applied a two-pronged test in line with the Privacy Act requirements: the institution holding the personal information must have a disclosure authority to disclose it to another institution, and the recipient institution must have a collection authority. These thresholds derive from existing Privacy Act jurisprudence. In other words:

  • CSE’s CII clients are required to meet the section 4 collection requirement of the Privacy Act by establishing a direct and immediate relationship (with no intermediary) between the information to be collected through a CII request and their operating programs or activities.
  • On CSE’s side, its disclosures of CII had to comply with section 8 of the Privacy Act, and the National Defence Act, which was the governing statute for CSE during the review period.
  • Because the disclosure authority within the National Defence Act required CSE to protect the privacy of Canadians, NSIRA assessed whether CSE evaluated each disclosure request rigorously on its own merits, including the operational justification provided by clients, to determine whether the requests were reasonable and whether the disclosure was appropriate under the Privacy Act regime.

CSE’s internal practices

NSIRA assessed CSE’s privacy protection measures for compliance with its legal responsibilities and Ministerial Direction. NSIRA assessed whether CSE’s CII disclosures are subject to a thorough, well-documented evaluation and approval process that demonstrates each disclosure’s compliance with legal and operational requirements. Specifically, NSIRA assessed whether CSE’s clients demonstrated their legal authority to collect CII, and did so in compliance with section 4 of the Privacy Act by showing a direct and immediate relationship between their mandated activities and the requested CII.

During the period under review, CSE received requests for 3,708 identifiers from 15 domestic departments, releasing 3,671 – which represents a release rate of 99%. This release rate was also reflected in the eventual sample of disclosures selected for detailed review by NSIRA. NSIRA expected to find disclosure requests of a consistently high quality commensurate with their near-absolute approval by CSE. Nevertheless, the findings below represent several areas in which NSIRA observed shortcomings.

Employee training and documentation requirements

CSE employees generally decide whether to release CII. NSIRA did not find evidence of written guidance or training to guide employees’ assessment of the substance of disclosure requests; instead, the training materials and procedures that employees receive primarily focus on the logistical processes to release CII.

In their assessment of CII requests, CSE personnel can take a range of actions, including conducting further research into a requesting department and its mandate or communicating with the requester to obtain clarity. NSIRA found that these actions are generally not documented for requests from domestic clients, and the approved disclosures only contain the requested CII without the reasons for approving the request. NSIRA was unable to confirm that CSE personnel were taking steps to communicate with a requestor to clarify incomplete or unclear disclosure requests.

While this is not a requirement in CSE’s policies for domestic requests, NSIRA observed detailed rationales provided by personnel responsible for approving and denying CII requests originating from foreign clients for CII. NSIRA believes CSE should require employees to document their assessment of requests from domestic clients, including the rationale for their approval.

In sum, NSIRA found that CSE’s employees do not receive sufficient written training and guidance on assessing the substance of disclosure requests and are not required to document mandatory actions and assessments they make when releasing CII. NSIRA recommended that CSE require, through procedures and policy, that employees document their decision-making and rationales and train them to assess the substance of disclosure requests in light of applicable legal obligations.

Management oversight

Certain types of disclosures are elevated for review and approval at a higher level within the organization. This is another process that lacked the appropriate documentation. Based on data compiled by NSIRA, all requests for CII reviewed at this level were approved, with no documentation of the rationale behind the decision to approve the remainder.

An internal monthly compliance check is conducted to confirm that releases of CII follow sufficient justification, that only the requested CII is released, and to determine whether any procedural errors have occurred. The compliance checks reviewed by NSIRA did not contain any analysis of the disclosure requests. While CSE explained that employees are informally coached if disclosures do not meet requirements, this is not documented within the compliance checks, which provide only statistical summaries of CII disclosures.

NSIRA found that personnel responsible for approving certain CII disclosures and conducting periodic compliance checks did not document their decision-making and assessment of requests. NSIRA recommended that similar to employees at the working level, CSE management must document their decision-making and rationales.

CSE’s assessment of CII disclosure requests

CSE’s CII disclosure request form requires that the requestor state an applicable legal authority for collecting the information. NSIRA observed requests where this information was not provided. In this context, NSIRA expected that CSE would follow up with requestors or assure itself through its own assessment that the requestor had the appropriate legal authority for collecting CII. NSIRA found no evidence that this process was taking place.

NSIRA used its ability to follow the thread of a disclosure and engaged some of CSE clients for CII regarding their legal authority to collect Canadians’ personal information. Where these departments had not indicated a legal authority to receive CII, NSIRA inquired directly with them about their legal authorities, receiving detailed legal assessments prepared in response to NSIRA’s questions. NSIRA found no documented evidence that CSE had similarly assured itself of the clients’ legal authorities at the time of disclosure.

As the custodian of incidentally collected CII, CSE has the responsibility to assure itself and document that both a collection and disclosure authority exist before sharing it with third party clients.

Next to a legal authority, the second key component of a disclosure request is the recipient’s operational justification for collecting the CII. A demonstrable operational nexus is required to justify a requester’s collection of CII in line with the Privacy Act regime.

NSIRA found that CSIS, the RCMP, and the Canada Border Services Agency (CBSA) generally demonstrated a clear link between the intelligence reporting and associated CII to their mandated activities, with some exceptions. This was a result of the strong operational justifications provided proactively by these clients, and does not reflect a more rigorous process on CSE’s end. Disclosures to these departments comprised approximately half of NSIRA’s sample.

CSE has accepted operational justifications provided by these and other clients that NSIRA found to be inadequate. In these cases, the clients’ justifications pertained to CII that was not demonstrably related to their mandate or operations.

From the sample of all disclosures reviewed by NSIRA, we found 69% to be justified, 28% to be insufficiently justified to warrant the release of CII, 2% that could not be evaluated, and 1% that CSE denied. Nevertheless, within this sample, CSE had approved these disclosure requests at a 99% rate.

CSE also released additional personal information to clients beyond that which was requested and explained this to be a standard practice. For example, NSIRA observed cases where CSE disclosed Canadians’ names and other personal information even when the recipient only asked CSE for a company’s identity. NSIRA observed other types of scenarios where CSE disclosed more identifiers than requested.

In sum, NSIRA found that CSE has not sufficiently assessed the legal authorities invoked by its clients and recommended that CSE and these clients obtain legal advice from the Department of Justice to determine the extent of their legal authority to collect CII. NSIRA further found that CSE’s implementation of its CII disclosure regime may not have been in compliance with the Privacy Act framework and recommended that CSE cease disclosing CII to clients other than CSIS, RCMP, and CBSA until it addresses the findings and recommendations contained in NSIRA’s review.

CSE’s governance of the disclosure regime

Many of the systemic issues presented in NSIRA’s review arise from CSE’s CII disclosure regime governance. CSE develops its internal policies, procedures, and legal assessments to which its disclosure clients are generally not privy. CSE’s existing arrangements with its clients govern operational issues such as security standards, information handling and system access. However, at an institutional level, NSIRA has not found a consistent understanding among CSE’s CII disclosure clients of the legal requirements underlying this practice.

A more transparent governance structure would allow all parties to understand and formally acknowledge at an institutional level the legal and operational requirements behind disclosing and collecting CII. It is not sufficient for CSE to manage the regime with its clients not privy to the policies, procedures, and legal requirements that underlie it.

NSIRA found that CSE’s governance of the CII disclosure regime does not foster an environment where its clients can take equal responsibility for CII disclosures. NSIRA recommended that CSE work with the Department of Justice and the Treasury Board of Canada Secretariat to establish Information Sharing Agreements with its regular domestic clients.

CSE’s disclosure of CII collected through its assistance to CSIS

Throughout the review, NSIRA encountered reporting and associated disclosures that pertained to activities of foreign persons within Canada. As CSE is prohibited from directing its activities at such persons, NSIRA submitted a series of questions and received briefings on the subject. NSIRA learned that CSE discloses CII collected as part of its assistance to CSIS in relation to section 16 of the CSIS Act.

Under section 16 of the CSIS Act, CSIS may assist the Minister of Foreign Affairs or the Minister of National Defence by collecting foreign intelligence within Canada in relation to Canada’s defence or international affairs. In turn, CSIS can apply to the Federal Court for a warrant, under section 21 of the CSIS Act, to obtain judicial authorization for intrusive collection powers in support of the section 16 investigation. Subsequently, CSIS may request CSE assistance if it does not have the tools or capacity to carry out this collection. CSE’s assistance takes the form of developing tools and techniques, intercepting target communications, decryption, report writing, and translation.

In its assistance to CSIS, CSE must respect the legal authorities and limitations imposed on CSIS by law and Federal Court warrants. In its documented requests for CSE assistance, CSIS does not explicitly request that CSE disclose the CII collected under warrant. Such disclosures are also absent from internal CSE plans that set out CSE’s support parameters. At the same time, both agencies insist that CSE can disclose such CII using its regular disclosure policies and procedures.

The practice of handling CII incidentally collected pursuant to section 16-related warrants has been the subject of ongoing treatment by the Federal Court. CSIS has described its own practices to the Court, including detailed summaries of how section 16 information is collected, its processing for intelligence reporting, and the rigorous disclosure regime associated with this reporting. CSIS also noted, in less detail and with omissions, some aspects of CSE’s parallel disclosure of CII collected through its assistance to CSIS under these warrants.

Overall, the stringent practices described by CSIS to the Court do not present a complete picture. For instance, CSIS’s limited distribution of section 16 intelligence reports and associated CII is not mirrored in CSE’s wider release of this information. Additionally, the senior approval levels that CSIS has in place for disclosing information about Canadian officials are also not reflected in CSE’s practices. In fact, CSE does not have a policy on how to treat Canadian officials’ information through its assistance mandate, and generally releases it at the working level. Further, CSE personnel are not generally aware that the information they are releasing originates from section 16 collection, and its associated Federal Court warrants and conditions. Moreover, CSIS has communicated to the Court that its own disclosure practice includes an assessment of a disclosure request by the operational branch responsible for the warrant, while CSE discloses such CII independent of CSIS operational branches.

In recent testimony before Parliament, CSE was asked how it operationalizes its assistance mandate. In its response, CSE stated that information collected under assistance is segregated, returned to CSIS, and belongs to CSIS, emphasizing that CSE effectively acts as an agent of CSIS in supporting section 16 activities. NSIRA is of the view that this is not a complete representation of the lifecycle of information collected by CSE in its assistance. By approving CSE’s section 16 intelligence reports, CSIS effectively releases ownership of this information to CSE, which was not conveyed to the Federal Court by CSIS in its affidavits detailing the reporting and use of section 16 information.

CSE’s treatment and dissemination of this information differs from the stringent standards communicated to the Court by CSIS, particularly when it pertains to Canadian public officials and other sensitive groups. NSIRA believes that fully describing the CII disclosure process during warrant applications is necessary to support the process of imposing any terms and conditions advisable in the public interest, as contemplated by paragraph 21(4)(f) of the CSIS Act.

Given the findings of the review, NSIRA recommended that the Federal Court be fully informed of CSE’s disclosure practices and that, in the interim, CSE cease disclosing CII incidentally collected under the authority of federal court warrants related to section 16 investigations.

Conclusion

NSIRA’s findings and observations over the course of this review indicate that CSE’s implementation of its disclosure regime may not be in compliance with its obligations under the Privacy Act. Throughout this review, CSE has defended practices that NSIRA believes do not reflect a commitment to rigorous implementation of the Privacy Act. Finally, CSE has released CII as part of its assistance to CSIS in a manner that contradicts the procedures communicated to the Federal Court.

Accordingly, NSIRA made a number of recommendations as outlined above, to improve the governance of CSE’s CII disclosure regime and to bring to the attention of the Federal Court important aspects of CSE’s disclosures of information acquired in relation to section 16 of the CSIS Act.

Share this page
Date Modified:

Review Of Departmental Implementation Of The Avoiding Complicity In Mistreatment By Foreign Entities Act For 2019

Completed Reviews

Review Of Departmental Implementation Of The Avoiding Complicity In Mistreatment By Foreign Entities Act For 2019


Backgrounder

In 2011, the Government of Canada implemented a general framework for Addressing Risks of Mistreatment in Sharing Information with Foreign Entities. The framework aimed to establish a coherent and consistent approach across government when sharing and receiving information with Foreign Entities. Following this, Ministerial Direction was issued to applicable departments in 2011 on Information Sharing with Foreign Entities, and then again in 2017 on Avoiding Complicity in Mistreatment by Foreign Entities.

On July 13, 2019, the Avoiding Complicity Act came into force. This Act codifies and enshrines Canada’s commitments in respect to the Canadian Charter of Rights and Freedoms, and Canada’s international legal obligations on prohibiting torture and other cruel and inhumane treatment.

On September 4, 2019, pursuant to section 3 of the Act, the Governor in Council (GiC) issued written directions to the Deputy Heads of the following 12 departments and agencies: Canada Border Services Agency (CBSA), Canada Revenue Agency (CRA), Canadian Security Intelligence Service (CSIS), Communications Security Establishment (CSE), Department of Fisheries and Oceans Canada (DFO), Department of National Defence and Canadian Armed Forces (DND/CAF), Financial Transactions and Reports Analysis Centre of Canada (FINTRAC), Global Affairs Canada (GAC), Immigration, Refugees, and Citizenship Canada (IRCC), Public Safety Canada (PS), the Royal Canadian Mounted Police (RCMP) and Transport Canada (TC).

The GiC issued directions focused on three aspects of handling information when interacting with a foreign entity: the disclosure of information, the requesting of information, and the use of any information received.

Pursuant to section 7 of the Act, every Deputy Head having received direction must, before March 1 of each year, submit to the appropriate Minister a report regarding the implementation of those directions during the previous calendar year. Following this, every Deputy Head must, as soon as feasible after submitting the report, make a version of it available to the public.

Date of Publishing:

Executive Summary

The Avoiding Complicity in Mistreatment by Foreign Entities Act (Avoiding Complicity Act or Act) and its associated directions seek to prevent the mistreatment of any individual as a result of information exchanged between a Government of Canada department and a foreign entity. At the heart of the directions is the consideration of substantial risk, and whether that risk, if present, can be mitigated or not. To do this, the Act and the directions lay out a series of requirements that need to be met or implemented when handling information. This review covers the implementation of the directions sent to 12 departments and agencies from their date of issuance, September 4, 2019, to the end of the previous calendar year, December 31, 2019. It was conducted under subsection 8(2.2) of the National Security and Intelligence Review Agency Act (NSIRA Act), which requires NSIRA to review, each calendar year, the implementation of all directions issued under the Act.

While this was the inaugural annual review under the NSIRA Act, it builds upon previous work in this area undertaken by NSIRA and its predecessor SIRC. NSIRA’s review on the 2017 Ministerial Direction on information sharing with Foreign Entities is an example. The results from this previous review were sent to applicable departments in July 2020. NSIRA is building upon this previous review and strongly supports the findings and recommendations within it. As of the date of this report, departmental responses have not been received regarding the recommendations provided in NSIRA’s July 2020 Ministerial Direction review.

(U) It was essential to ensure that both NSIRA and the departments being reviewed met their obligations under the Avoiding Complicity Act and the NSIRA Act. The approach used to gather information during a global pandemic was purposely designed for this first and unique review period.

To capture a complete view on the departmental implementation, NSIRA requested information that related directly to every department’s specific obligations under the Act and the directions. The responses and associated information captured departmental activities related to the Act during the review period, and what procedures, policies, tools, etc. (frameworks) were leveraged to support these activities. NSIRA believes that having a robust framework is an essential part of an effective implementation of the directions departments have received.

Beyond the specific requirements of implementation, the information provided by the departments also helped to identify gaps, considerations for best practices, and the work departments have undertaken since the review period to build and formalize their frameworks. This information and knowledge will help set up the foundation for future reviews and assist efforts on creating consistent implementation across departments. While many of the issues discussed in this report go beyond the specific requirements of the directions, their consideration is critical to the overall improvement of the implementation process and how departments ultimately support the Act. No case studies were undertaken for this review. However, the information gathered has helped establish a baseline for overarching issues the community is facing. Building on this, future reviews will begin to examine specific sharing framework challenges and questions and look closely at specific cases and departmental legal opinions to guide review findings.

While NSIRA was pleased with the considerable efforts made by many departments new to the Avoiding Complicity Act in building up their supporting frameworks, it was clear during this review that departments are employing very different approaches to guide their information handling activities. The responses received demonstrate various inconsistencies across the departments. Having a consistent and coordinated approach when addressing the concerns related the Act is not a requirement for implementation, however, NSIRA believes that there is value in such an approach. And while departments will always require unique aspects in their sharing frameworks to address the unique characteristics of their mandates and activities, to improve the implementation process, a goal all involved likely have, the identification and sharing of best practices is critical.

For example, determining the best means for having a unified approach when engaging with foreign entities of concern or ensuring that an information sharing activity is consistently evaluated for risk by all departments. The recommendations provided on these issues in this review capture what NSIRA believes to be important concerns and considerations for supporting and improving departmental implementation.

Additionally, as the directives received under the Act do not describe the specific means by which departments ‘implement’ them, it is incumbent on the community to ensure that they have sufficiently robust frameworks and programs in place to fully support an assertion of implementation. Therefore, the information gathered during this review went beyond a strict assessment of implementation, but also considered the aspects required to better support this implementation. Going forward, this approach will help establish the foundation for subsequent reviews. Drawing on the findings and concerns identified here, NSIRA will continue to consider aspects that will ultimately improve underlying frameworks, thereby supporting an improved implementation of the Act across the community.

Authorities

This review was conducted under subsection 8(2.2) of the NSIRA Act, which requires NSIRA to review, each calendar year, the implementation of all directions issued under the Avoiding Complicity Act.

Introduction

Focus of the Act

In the same spirit as the Ministerial Direction (MD) that preceded it, the Avoiding Complicity Act and its associated directions seek to prevent the mistreatment of any individual due to the exchange of information between a Government of Canada department and a foreign entity. The Act also aims to limit the use of information received from a foreign entity that may have been obtained through the mistreatment of an individual. While the previous MD guided the activities of a selection of Canada’s security and intelligence departments, the Act broadened this scope to capture all departments whose interactions with foreign entities included information exchanges where such a concern may apply.

The focus of the Act is to ensure departments take the necessary steps during their information sharing activities to avoid contributing in any way to the mistreatment of an individual. To do this, the Act and the directions lay out a series of requirements that need to be met or implemented when handling information. There is an expectation that each department will satisfy these requirements by leveraging departmentally established mechanisms and procedures, or frameworks that will allow each department to confidently demonstrate how it has responded to its responsibilities under the Act.

During the first year that the Act was in force, written directions using nearly identical language were sent to the Deputy Heads of 12 departments. In regard to disclosure, the directions read as follows:
“If the disclosure of information to a foreign entity would result in a substantial risk of mistreatment of an individual, the Deputy Head must ensure that Department officials do not disclose the information unless the officials determine that the risk can be mitigated, such as through the use of caveats or assurances, and appropriate measures are taken to mitigate the risk.”

With respect to requesting information, the directions state:
“If the making of a request to a foreign entity for information would result in a substantial risk of mistreatment of an individual, the Deputy Head must ensure that Department officials do not make the request for information unless the officials determine that the risk can be mitigated, such as through the use of caveats or assurances, and appropriate measures are taken to mitigate the risk.”

Lastly, as it relates to the use of information, the directions indicate:
“The Deputy Head must ensure that information that is likely to have been obtained through the mistreatment of an individual by a foreign entity is not used by the Department

  • (a) in any way that creates a substantial risk of further mistreatment;
  • (b) as evidence in any judicial, administrative or other proceeding; or
    (c) in any way that deprives someone of their rights or freedoms, unless the Deputy Head or, in exceptional circumstances, a senior official designated by the Deputy Head determines that the use of the information is necessary to prevent loss of life or significant personal injury and authorizes the use accordingly.”

At the heart of the directions is the consideration of substantial risk, and whether that risk, if present, can be mitigated or not. This determination is done on a case-by-case basis. Each department is responsible for making these determinations as it applies to its activities. Following the outcome of a department’s determination of these important questions, cases may be approved, denied, or elevated to the Deputy Head for consideration. For the latter cases, this then results in additional reporting requirements for the Deputy Head. Throughout this process, there is also a requirement to ensure the accuracy, reliability, and limitations of use of all information being handled.

Review Objectives

After the Avoiding Complicity Act came into force in July 2019, the Governor in Council’s written directions were sent to each applicable department in September 2019. The period for this year’s review is September 4, 2019 to December 31, 2019. The short timeframe (approximately 4 months) associated with this year’s review means that departments are being assessed, in large part, on what they would already have had in place to address risks of mistreatment associated with information sharing, or what they were able to implement in a four-month window. NSIRA is cognizant that for the departments that were not previously subject to the 2017 MD on Avoiding Complicity in Mistreatment by Foreign Entities, the timeframe to implement the written directions was somewhat limited, as it would have been challenging to create and operationalize new procedures such that they would be reflected in the department’s activities during the period being reviewed.

While it was essential to ensure that both NSIRA and the departments being reviewed met their obligations, these challenges were kept in mind when evaluating the objectives for this first review. Given these considerations, the objectives of this year’s review were to determine whether:

  • departments had fully implemented the directions received under the Act in conformity with the obligations set out therein;
  • departments had established and operationalized frameworks that sufficiently enabled them to meet the obligations set out in the Act and directions; and,
  • there was consistency in implementation across applicable departments.

Methodology and assessment focus

To capture a complete view of the departmental implementation of the Act, NSIRA constructed a series of questions related directly to every department’s obligations under the Act and the directions. The responses and associated information captured what specific activities took place during the review period and what departmental frameworks were leveraged to adequately support these activities.

The information provided by the departments also helped to identify gaps, considerations for best practices, and the work departments have undertaken to build and formalize their frameworks to meet their obligations under the Act and directions. The information provided and the knowledge gained will help set up the foundation for future reviews and help create consistent implementation across departments.

The method used to gather information during a global pandemic was designed for this first and unique review period. We believe it allowed departments to quickly and efficiently indicate both whether the directions had been implemented, and what frameworks, processes, and policies had been leveraged or put in place.

Responses to many of the RFI questions were simply yes/no answers. Often, answers were dependent on what information handling activities took place with foreign entities by the department during the review period. As such, a number of questions could be returned with ‘not applicable’, and this was an acceptable response. Many of the questions were related to specific and easily defined requirements under the Act and its associated directions, e.g. ‘was a report submitted to the Minister?’ or ‘Did the Deputy Minister inform the applicable bodies of all their decision made under the act?’.

Other questions were designed to capture the details of the underlying processes that supported a department’s implementation, i.e. a department may indicate that they ensured no substantial risk of mistreatment was present in any of their information sharing activities, but how did they support this claim? Likewise, for an assertion that a possible substantial risk of mistreatment had been mitigated, what was in place that allowed a department to make this assertion? Therefore, this series of questions required sufficiently detailed responses to fully capture what a department had in place that allowed it to confidently state that it has met its implementation obligations under the Act and the issued directions.

Finally, a portion of the questions was intended to capture the level of uniformity in implementation across departments. This includes such things as country/entity assessments, triage practices, and record keeping. Much of this information will also help with recommendations going forward. This multi-faceted approach resulted in three main areas being evaluated to assess implementation for this review period and help set the groundwork for future reviews.

  • Departments have clear and comprehensive frameworks, policies, and guidelines such that they can demonstrate how they have fully implemented the directions under the Act.
  • All reporting requirements associated with both the Act and its applicable directions have been met.
  • Differences or gaps associate with areas such as country/entities assessments, record keeping, case triage, etc., such that consistent implementation across departments would be challenging.

Summary of the results table

The table in Annex A captures a summary of both the departmental responses to the implementation questions and NSIRA’s assessment regarding these responses. The assessment was based on the associated details provided by departments in the context of the specific information requested. As explained above, many of the responses were returned as not applicable (n/a). Since many implementation requirements are connected to specific activities, the absence of such activities would mean that the requirement does not come into play. The best example of this for the current review is the absence of any Deputy Minister level determinations. All 12 departments indicated that they did not have any cases referred to the Deputy Minister level for determination. All additional reporting requirements associated with this level of decision were not applicable and thus considered satisfied.

If a specific requirement was not met, it was flagged. The relatively few instances of this were connected with departments not meeting certain reporting obligations under the Act. In all cases, the department involved pre-identified these missing requirements and indicated that efforts were underway to address them.

The concerns and findings captured in the table (and others) are discussed subsequently. A concern was flagged in two situations: where there was an uncertainty associated with a department’s ability to support their implementation requirements; and cross-cutting issues related to general aspects of all of the frameworks described, both of which led to the findings and recommendations proposed.

Findings and Recommendations

Realities of Implementation for 2019

A challenge for departments for this first review was associated with one of the assessment items listed above, i.e. whether they had established frameworks to demonstrate how they supported the implementation of the directions they received.

With the Avoiding Complicity Act coming into force in July 2019, it was not feasible that departments would create and stand-up new frameworks for information exchanges in time for the period being reviewed. Although the Act did specify several Deputy Heads that were to receive directions, it only included those who received the previous 2017 MD. The remaining new departments received their directions in September 2019. Regardless of this two-month difference, each department would have been required to rely on, to some extent, existing procedures when handling information sharing with foreign entities during the review period.

This put the departments that had previously formalized policies and processes at an advantage when implementing the directions. For those departments who were not subject to the previous 2017 MD on information sharing, NSIRA considered how they leveraged and adjusted what was already in place to respond to their new responsibilities under the Act. What we then expected to see, for all departments, was what subsequent steps were taken during the review period and afterwards, to either adjust or create frameworks to better meet implementation requirements going forward. NSIRA noted that in response to questions on frameworks for handling information and mitigating risk, several of the departments new to the considerations of the Act provided extensive detail on their efforts and progress on building out their frameworks to support the directives. References to having these frameworks formalized over the subsequent year were also encouraging.

Finding no. 1: NSIRA found that several departments, new to the considerations of the Act, described considerable progress being made during the review period and afterwards to build out formalized frameworks to support implementation.

Importance of establishing operational framework

As discussed, having fully established operational frameworks in place for this review period may not have been feasible for the departments that did not previously have processes to support their activities. This, however, did not exempt a department from the requirements of implementation. Each department was still expected to leverage what it currently had in place to properly address the concerns associated with the Avoiding Complicity Act. Furthermore, there was a logical follow-on expectation that departments would take subsequent steps to build out formal frameworks to address any perceived gaps to support the implementation of the Act going forward if necessary.

After reviewing the responses received, NSIRA is concerned that departments with minimal information sharing activities taking place during their operations have yet to address the necessity of having a robust framework in place, regardless of how often that framework is leveraged. For example, although PS and TC may primarily act as facilitators or coordinators for information exchanges on specific programs, they are still interacting with foreign entities, and therefore are required to fully assess their interactions with a foreign entity in this regard.

If a department without a formal framework assesses that it has few or no cases associated with the Act, then it may believe it is adequately positioned to address any sharing concerns should they arise. This, however, is not the case. Even single instances of information exchange in which the concerns of the Act may apply require a framework to support it properly. In many cases, it will be the framework itself that properly identifies whether a sharing activity raises concerns under the Act. If there is no formal process in place, then this identification becomes problematic. Simply saying that there are no cases or activities associated with the Act is not sufficient. That determination can only be made after a sharing activity is scrutinized through the lens of a robust framework. Going forward, all departments who receive directions should demonstrate a formal framework that ensures all information sharing activities are adequately evaluated against the considerations of the Act.

Finding no. 2: NSIRA found that departments conducting minimal information exchanges with foreign entities have not yet fully addressed the importance of having an official information sharing framework in place.

Recommendation no. 1: NSIRA recommends that all departments in receipt of directions under the Act have an official framework that ensures they can fully support their implementation of the directions.

Community coordination and best practices

While departmental coordination and the sharing of best practices are not a requirement of the Avoiding Complicity Act or the directions, NSIRA considered such an approach’s value. What became clear during this first review was that every department employs a very different framework to guide their information sharing activities with foreign entities. This is to be expected to some extent, given the different mandates, sharing requirements, and areas of focus associated with each department. However, these differences are also a reflection of the independent, internal development that has taken place for the different frameworks being used. While the departments receiving directions under the Act do interact on this subject to some extent, to date, based on the responses provided, it appears that the majority of the work done by the departments to build supporting frameworks to address their responsibilities associated with the Act have been done so independently. There was little to no overlap with how departments described the various aspects of their frameworks, even amongst the departments subject to the earlier MD on this issue.

There would be value in departments collectively identifying the key aspects common or required in all information exchanges with foreign entities and then working together to craft best practices, irrespective of what a department currently has in place. This process should draw on all available resources to make this determination. Each department can then turn to their existing frameworks to consider where and how they can be adjusted to match this community-agreed upon ideal. This is not to say that aspects of what a department already has in place in their framework will not ultimately be seen as the best practice. Several departments do have robust sharing frameworks in place, and these will contribute significantly to this exercise. However, arriving at this determination independently will provide an additional level of confidence.

Department-specific challenges, of course, cannot be ignored. In fact, they will weigh in strongly on such a conversation. Departments share information under their mandates for various reasons, and this will mean that coordination on certain aspects of a sharing framework may not be possible. However, this needs to be evaluated. It is important that what already exists, or what is hard change, does not unduly influence what may be best. This approach will create uniformity (where possible) across the community and provide a starting point for ‘must haves’ for each department to evaluate their existing processes against.

The Public Safety Information Sharing Coordination Group (ISCG) was established to support departments on information sharing. As such, it is in an ideal position to help mitigate issues arising from the lack of coordination. Leading such efforts would build on the work already being done by this group. During recent discussions with NSIRA, the ISCG indicated that the tracking of lessons learned and the sharing of best practices was not yet routine. Going forward, there would be value in a more coordinated effort when departments are updating/changing their framework. Ensuring that this coordination takes place will require support and leadership by senior-level officials. This will help in sharing best practices once identified, and establish more consistent approaches across departments.

Finding no. 3: NSIRA found that the differences and variability in departmental frameworks demonstrate a previous lack of coordination across the community and a need to identify best practices.

Recommendation no. 2: NSIRA recommends that departments coordinate to identify best practices for all essential components of information sharing frameworks and that the ISCG is leveraged to ensure these practices are shared where possible across the community to support the implementation of the Act.

Framework application inconsistency

A series of questions in this review was related to aspects of consistency in how departments apply their frameworks. From this series, a comparison was made on how many times an information sharing/use event triggered an evaluation of any kind against the considerations of the Avoiding Complicity Act, versus how many of these triaged cases were elevated or referred up for decision. The results helped gauge two important aspects of a framework: One, the threshold requirements, i.e. how often a sharing activity triggers an evaluation of any kind; and two, the decision making power given to the operators who are initially handling these activities.

The feedback and the responses received demonstrate potential inconsistencies in both aspects across departments. For example, several departments indicated zero cases as being triaged/evaluated under the concerns of the Act during the review period, yet also specified that they are involved in regular information sharing or, specified that no information received from foreign entities was derived from mistreatment. These responses appear to be inconsistent as it would be problematic to participate in information sharing or to make such mistreatment determinations without the activity being evaluated on some level.

Other departments indicated a larger number of cases as initial triaged/evaluated, but also indicated that none of them were elevated in their decision making process for higher-level decisions. This would seem to suggest that all determinations were being made at the operational level. Such a result puts significant weight on the operator and the initial assessment tools they are leveraging if they are making all determinations independently. This reinforces the importance of a robust framework to help make these determinations, as previously indicated in Finding no. 2. As a result of these differences, potential challenges arise on accurately assessing the volume of cases being handled by departments, the tracking of those cases deemed to present a substantial risk, those which can be mitigated for, and those where the risk was not found to be substantial or even present.

These responses may result from how each department defines a ‘case’ or how it records a case, or they may be a result of differences in how a department’s decision-making process is leveraged. NSIRA’s concern is that these differences may indicate an inconsistency in application thresholds at different departments. As such, the following results were viewed as a potential issue based on the responses received:

  • if a department was involved in any kind for information exchange with a foreign entity during the review period, but did not indicate that any cases were formally triaged/evaluated; or
  • if there was a significant number of cases triaged, but none were elevated to a higher level for determination.

Such results do not necessarily indicate a problem as aspects of a framework may be able to account for this, however, looking further into how and why the department’s framework produced these outcomes is important. Future reviews will be able to do this. Consistent initial steps for information sharing activities, including triage/evaluation thresholds and documentation, are critical to the effective application of a framework, and ultimately to identifying best practices.

Finding no. 4: NSIRA found that there are inconsistencies in the application of existing sharing frameworks between departments, specifically concerning information evaluation thresholds, and decisions being elevated for senior level determinations,

Recommendation no. 3: NSIRA recommends that departments establish consistent thresholds for triggers in their information sharing frameworks, including initial evaluations against the concerns of the Act, when a case is to be elevated in the decision process, and how this is documented.

Country and entity assessments

A key recommendation of NSIRA’s previous review on information sharing related to the country/entity assessments being used by departments to inform their decision making process when sharing or using information with a foreign entity. While the use of country/entity assessments is not a required aspect of implementing the directions under the Act, NSIRA continues to support this tool as an important aspect of any sharing framework. In its previous review, NSIRA determined that having a firm grasp on the human rights situation, as well as any other pertinent information associated with a country/entity, was essential to making an informed decision on whether there should be concerns, caveats, or limitations when handling information with that country/entity. Moreover, having such information captured to ensure all departments consistently approach these countries/entities is critical. At the time of the previous review, the following recommendation was made:

  • a unified set of assessments of the human rights situations in foreign countries including as standardized ‘risk of mistreatment’ classification level for each country; and
  • to the extent that multiple departments deal with the same foreign entities in a given country, standardized assessments of the risk of mistreatment of sharing information with foreign entities.

It is important to note that there has been no formal response from departments on this previous recommendation as of the date of this report. Furthermore, during this report, two departments continue to raise concerns with NSIRA’s stance on this issue during the consultation process. While NSIRA continues to support this recommendation, as explained below, further discussions with departments on how to approach this matter may be warranted, specifically on the distinction between how this recommendation may apply to a foreign country/entity vs a specific foreign partner a department may be dealing with.

Based on the responses provided on this topic for the current review period, there is still inconsistency in this area. While almost all departments indicated that country/entity assessments were a standard part of their framework, the responses also indicate differences in which country assessments are used, how they are leveraged, and who is responsible for updating them. For example, several departments rely on their own in-house created assessments, while others leverage the assessments created by Global Affairs Canada and others. While departments who indicated that they are leveraging country/entity assessment tools in their process also indicated that these assessments captured human rights concerns, this has yet to be independently evaluated. NSIRA is concerned that these differences could result in different approaches/stances being taken by departments when dealing with the same foreign entity. While the country/entity assessments tools themselves are not necessarily in question, the fact that every department is not leveraging or does not have access to all useful or applicable information is.

NSIRA remains of the view that having a consistent stance on all countries and entities when implementing the requirements of the Act is important. Issues such as mistreatment and human rights should not be decided at a departmental level, but on a whole-of-government level. While mindful of classification levels, ensuring all departments have access to the same relevant information associated with a foreign country/entity is critical to making an informed decision. Due to the nature of their work, departments may be privy to unique information on a country/entity, some or all of which can be shared. This would lead to fully informed assessments that allow for a consistent approach when dealing with any country/entity. In addition to improving duplication of effort in this area by departments, NSIRA continues to see standardized country and entity assessments, which can be accessed and contributed to by all departments, as key to moving toward a more consistent and effective implementation of the Act across the community

Finding no. 5: NSIRA found a lack of unification and standardization in the country and entity assessments being leveraged by departments, resulting in inconsistencies in approach/stance by the community when interacting with Foreign Entities of concern related to the Act.

Recommendation no. 4: NSIRA recommends that departments identify a means to establish unified and standardized country and entity risk assessment tools to support a consistent approach by departments when interacting with Foreign Entities of concern under the Act.

Conclusion

While aspects of implementation can be easily quantified and evaluated e.g. reporting requirements to a Minister, others, which support implementation are more difficult to measure, e.g.:

  • What does a sufficiently robust framework for assessing and mitigating risk when sharing with a foreign entity look like?
  • Does this depend on the specific requirements and activities of the department; or,
  • Are there steps that should always be involved when vetting a foreign entity under the considerations of the Act?

Measuring and weighing the answers to such questions is challenging. They are more nuanced, and can’t be as easily quantified. Regardless, they must be considered and addressed. Drawing on the considerations and concerns identified in this review will help departments to ask the questions that will improve their underlying frameworks with the following goals in mind:

  • To identify the essential/key elements that need to be a part of any framework for it to address the concerns associated with the Avoiding Complicity Act sufficiently; and,
  • To have all identified best practices implemented as consistently as possible across departments.

Future reviews will push towards these goals by seeking answers to those questions above. By looking more closely at specific case studies, departmental legal opinions, items of inconsistency, and the departmental frameworks that are already demonstrating best practices that should be shared. Ultimately the results of such efforts will contribute to improving the implementation of the Act across the community.

Share this page
Date Modified:

Review of the Communications Security Establishment’s Self-Identified Privacy Incidents and Procedural Errors

Table of Contents
No header Tag found

Date of Publishing:

Share this page
Date Modified: