Backgrounder
A redacted version of the National Security and Intelligence Review Agency’s (NSIRA) Survey of the Canadian Security Intelligence Service (CSIS)’s Technical Capabilities was recently released under the Access to Information Act.
CSIS uses technical capabilities to support its investigations into threats to Canada’s security. As national security threats become increasingly technically enabled, CSIS must ensure its technical capabilities, governance structures, and legal frameworks continue to evolve while protecting Canadians’ rights and privacy.
The survey provided NSIRA with a foundational understanding of CSIS’s technical capabilities, how they are governed, and the risks associated with their use. Its observation also helped inform NSIRA’s first technology-focused review, CSIS Lifecycle of Warranted Information.
Why NSIRA conducted this review
NSIRA reviews CSIS’s activities for compliance with the law and whether they are reasonable and necessary. To do this effectively, NSIRA must understand the technologies CSIS uses and how they affect intelligence collection.
This review helped NSIRA identify areas where additional review may be needed, particularly for higher-risk technologies involving advanced collection methods, large amounts of data, or where collection incidentally occurs from people who are not the subject of an investigation.
Why this matters to Canadians
Technical capabilities can support important national security work, but their use may also affect privacy and other rights. CSIS activities are governed by legislation and Federal Court warrants, which set limits on how information can be collected.
Because technology changes quickly, independent review helps ensure that CSIS’s use of these capabilities remains lawful, reasonable, and necessary.
Key observations
NSIRA found several areas where CSIS could strengthen the management of technical capabilities:
- Policies and guidance needed updating. Outdated policies and reliance on interim direction increased compliance risks.
- Compliance responsibilities required stronger coordination. A decentralized approach created challenges in maintaining a complete view of compliance risks.
- External technologies created additional risks. The use of partner or third-party technologies can make it more difficult to assess privacy, security, and compliance considerations.
- Performance measurement needed improvement. CSIS lacked a consistent way to assess the effectiveness and value of its technical capabilities.
- Tracking of warrant details within operations should be strengthened. NSIRA found that CSIS should strengthen its documentation of activities conducted under Federal Court warrants to better demonstrate compliance with the limits and conditions set by the Court.
Recommendation and Next steps
NSIRA recommended that CSIS share the full, unredacted version of the report with designated judges of the Federal Court. CSIS agreed to this recommendation.
The knowledge gained through this survey continues to help guide NSIRA’s reviews of CSIS’s use of technical capabilities, including higher-risk technologies and activities requiring further review. It remains a valuable resource for identifying areas of greater risk and helping NSIRA prioritize future review work.