Lux Ex Umbra

Globe and Mail reporter Omar El Akkad has written an article examining the role played by NSA and CSEC in the certification of deliberately weakened encryption ("The strange connection between the NSA and an Ontario tech firm," Globe and Mail, 20 January 2014):

At the heart of digital security is the concept of encryption – making information indecipherable to anyone who doesn’t have the right passcode.

And since 1995, any software developer building encryption for technology they intended to sell to the American or Canadian government has had to consult something called the Cryptographic Module Validation Program. It’s a list of algorithms blessed by the CMVP that are, according to the government agencies that publish it, “accepted by the Federal Agencies of both countries for the protection of sensitive information.”

There’s only one problem. For more than six years, one of the central items listed in the CMVP – an algorithm for generating the random numbers that form the foundations of an encryption scheme – has had a glaring and well-known backdoor, a means of rendering the encryption totally ineffective.

...

For years, many wondered why the NIST in America and CSEC in Canada would continue to give their official blessing to a compromised algorithm. Last year, a potential answer to that question emerged, when documents leaked by Edward Snowden revealed the NSA to be a holder of the Dual_EC secret keys – essentially, allowing the spy agency to crack the encryption at will. In addition, a Reuters report in December revealed that the NSA had paid RSA Security LLC $10-million to continue making Dual_EC the default form of encryption on its products.

The Globe and Mail article also looks at the role of the Canadian company that developed the Dual_EC_DRBG algorithm, Certicom Corp., which was purchased by Blackberry in 2009.

(Also interesting is the Twitter link that El Akkad posted pointing to this 2003 press release announcing the licensing of Certicom's encryption technology by the NSA.)

The Cryptographic Module Validation Program was established by CSE and the U.S. National Institute of Standards and Technology in July 1995.

[Update 19 November 2014: The new CSE CMVP page is here. The old page can be read here. H/T to Ron Deibert.]

As it happens, I have the 1995-96 Business Plan of CSE's Information Technology Security (ITS) Program sitting on my desk right now. (Fear not, security folks; it's the redacted version that was released under the Access to Information Act.)

The unredacted portion of the document doesn't mention the CMVP, and it most certainly doesn't mention that NSA and CSE might use the program to foist crippled encryption on the public.

But it does make the following rather interesting comment, which given the news coverage of the past six months is even more relevant today:

The SIGINT program... has recently experienced high visibility in the press. As a result, CSE has become synonymous with the SIGINT mission even though the organization's name was originally based on the COMSEC [communications security] mission. Now, even more than ever, ITS's association with SIGINT has the potential [of] negatively affecting its reputation as a trusted security organization. CSE's communication policy has also restricted marketing efforts crucial to the success of the ITS program. To succeed, the program will initiate a number of actions which will ensure its reputation and image as a trusted security organization.

Good luck rebuilding that trust now.

Previous coverage of this case here.

In this post, I'm going to write about some of the interesting stuff in the 2017-18 annual report of the Office of the CSE Commissioner (OCSEC), which was released last summer. In particular, I'm going to look at the decline in the number of private communications used or retained by CSE and whether that decline means that the spread of encryption is beginning to have a serious effect on CSE SIGINT operations.

But first a quick aside about the 2018-19 report, which may be about to be released.

In July, as a result of the long-awaited passage of Bill C-59, CSE Commissioner Jean-Pierre Plouffe was reflagged as the Intelligence Commissioner and OCSEC was shut down, with most of its duties reassigned to the brand new National Security and Intelligence Review Agency (NSIRA). This means the 2018-19 report will be the last of its kind.

As far as I can see the government now has just one date left, August 21st, to release that final report before parliament is dissolved for the fall election. If the 2018-19 report does get released a few days from now that probably will mean there isn't anything too newsworthy in it. If, on the other hand, the government hangs on to it until after the election that may be a sign there's something a bit more, er, exciting in it.

CSE nerds may recall that the only other OCSEC report to be withheld through a federal election in recent years, the 2014-15 report, was the one that revealed the only case in which CSE has ever been declared to have violated the law.

Nobody in Ottawa ever clues me in on anything, so I haven't heard anything suggesting that a similar bombshell is inbound this time around. But a delayed release would certainly look suspicious. I guess we'll just have to wait and see what happens.

[Update 22 August 2019: The 2018-19 report did not get tabled on the 21st, so I'm pretty sure we won't be seeing it until sometime after the October election. Makes you wonder if there isn't something embarrassing for the government in it. Hooray for transparency!

A happy thought: Like OCSEC's reports, by law NSIRA's annual reports have to be tabled within 15 sitting days of being submitted to the government. However, since NSIRA's reports will cover calendar years and thus probably will be completed around March of the following year, this should mean they get released sometime during the spring sitting instead of routinely getting delayed into the summer and potentially withheld through elections (now normally held in the fall).]

In the meantime, the possibility that the 2018-19 report could drop in just a matter of days has reminded me that I still haven't said much about the 2017-18 report, which was tabled in parliament over a year ago on July 18th, 2018.

So back to that report:


Private communications decline to 954

In its 2017-18 report OCSEC reported for the fifth year in a row the number of recognized "private communications" that were acquired by CSE under Part A of its mandate ("Mandate A") and subsequently used in SIGINT reporting or otherwise retained as "essential" for foreign intelligence purposes. The 2017-18 report revealed that 954 private communications were used or retained during the period from July 2016 to June 2017 inclusive.

As the table below shows, this was a 70% decline from the previous year's total, which was 3348, but it was still much higher than the totals in any of the years before that. The 2017-18 report and the previous one also reported how many of those private communications were actually used in end-product reports (EPRs), and that number too declined in the most recent period, from 533 to 261 (51%). These declines occurred despite the fact that, as the Commissioner also reported, the overall number of private communications intercepted "continued to increase substantially."



So this is the overall picture that confronts us: The increase in the number of PCs used or retained between 2013-14 and 2015-16 was truly eye-popping. But now, although the total number of PCs collected continued to grow in 2016-17, we're faced with a sudden significant drop in the number used or retained.

What is going on here?

Well, let's unpack the data a bit first.

In Canadian law a private communication (PC) is an oral or electronic communication between two or more persons, regardless of nationality, where at least one of the communicants is physically located in Canada at the time of the communication. (The legal definition is a little more complicated, excluding broadcasting and other forms of public communication for example, but that's the gist.) The interception of PCs is illegal except under certain specific circumstances provided for in the Criminal Code.

One of these exceptions covers CSE's Mandate A activities when it is operating under a ministerial authorization issued for that purpose. Mandate A is CSE's mandate to acquire foreign intelligence, which is "information or intelligence about the capabilities, intentions or activities of a foreign individual, state, organization or terrorist group, as they relate to international affairs, defence or security." In keeping with this definition, Mandate A ministerial authorizations are restricted to collection activities directed at non-Canadian targets physically located outside of Canada: CSE is not legally permitted to direct its Mandate A activities at persons in Canada (or Canadians anywhere).

So how does CSE end up with PCs acquired under Mandate A? The answer is actually pretty simple. All communications have at least two ends. Sometimes the non-targeted end of a foreign communication that CSE collects turns out to be in Canada. This is called "incidental" collection. Because one end is in Canada, such communications are legally PCs, but their collection is permitted as long as one of the aforementioned authorizations is in place. (And it always is.)

When a CSE foreign intelligence analyst examines an intercepted communication they try to establish the location of the communicants in order to determine whether it is a PC. Recognized PCs collected under Mandate A can only be retained by CSE if they are determined by the analyst to be essential to international affairs, defence, or security. Some of the retained PCs end up quoted or otherwise cited in the end-product reports provided to CSE's SIGINT clients, while others may be retained for background information or because their importance is unclear. These are the PCs whose use or retention is reported by OCSEC. Retained PCs must be reassessed for essentiality after an undisclosed interval and are normally ultimately deleted unless they have been used in an EPR.

This is not the only way in which CSE can end up in possession of Canadian-related communications, however. The agency also sometimes collects communications in which the non-targeted end turns out to be a Canadian located abroad. Because in this case none of the participants in the communication are located in Canada, these communications are not PCs and are not counted in the total reported by OCSEC. Stored communications such as texts and e-mails acquired by CSE from computer hacking activities or company databases are also not counted as PCs, even if one of the communicants was located in Canada when the communication was originally sent. Canadian communications acquired by allies and subsequently provided to CSE are also not considered to be PCs. (Such collection is said to be "exceptional", but it does occur.) Finally, CSE acquires PCs and other Canadian-related communications incidentally in the course of its Mandate B (IT security) activities and intentionally in the course of its Mandate C (support to federal law enforcement and security agencies) activities. None of these numbers are publicly reported.

The private-communications-collected-by-CSE-in-the-course-of-Mandate-A-activities numbers do, however, provide important, if only partial, insight into the nature and evolution of CSE's collection of Canadian communications in the course of its foreign intelligence activities. So let's turn back to the numbers.


Smartphones and instant messaging

As I've argued before, the major jump in the number of used/retained PCs between 2013-14 and 2015-16 was probably a consequence of changes in the types of communications most commonly being intercepted. My guess is that the rise of smartphones and consequently mobile messaging applications accounts for most of the difference. Since each separate comment posted in a message app probably counts as a separate private communication, just one single extended conversation monitored by CSE might be counted as dozens or even hundreds of PCs.

If this is the case, then the huge increase in PCs used or retained in recent years is almost certainly primarily due to this change in communications technology and does not imply a huge—or even necessarily any—increase in the number of Canadians and other persons in Canada whose communications are getting caught in CSE's dragnet.

Although he hasn't confirmed that messaging apps are the explanation, the CSE Commissioner has more or less confirmed that the answer is something along these lines, describing the increase as "a consequence of the technical characteristics of certain communications technologies, and CSE’s legal obligations to count private communications in a certain manner" and adding that "the current manner in which CSE counts private communications provides a distorted view of the number of Canadians or persons in Canada that are involved".

It is possible, however, that there also was at least some increase in the number of Canadians or other persons in Canada whose communications were collected by CSE after 2014. While messaging apps are almost certainly the primary explanation for the jump, the timing of the increase might also be related to the resumption in mid-2015 (under a new, undisclosed name) of Domestic Interception of Foreign Telecommunications and Search (DIFTS) warrants, which enable CSIS to ask CSE to monitor specific Canadians abroad.

Neo-DIFTS intercepts would not appear directly in these statistics even if one end was in Canada, because collection for CSIS is a Mandate C activity. But such intercepts might enable the identification of new foreign targets, such as ISIS members involved in efforts to recruit Canadians, and those recruiters could then be targeted under Mandate A and possibly be monitored communicating with additional, previously unidentified Canadians. So it is not inconceivable that the advent of neo-DIFTS warrants led indirectly to at least a small increase in PCs collected under Mandate A.

In any case, since smartphones seem to have been ISIS's main mode of communications, many Canadians had travelled to Syria and Iraq to support the organization, active efforts were underway by ISIS to recruit others to come or to engage in attacks or other activities in Canada, and the Canadian Forces were participating in the anti-ISIS coalition, it seems plausible that ISIS members were among CSE's key targets throughout this period and that they may well have been responsible for many of the messaging-app PCs intercepted by the agency.


Why the drop?

So why did we see the sizable drop in used/retained PCs in the 2017-18 report?

It's risky to draw sweeping conclusions from a change reflected in just a single year's data, but assuming the phenomenon is real, three not necessarily mutually exclusive possible explanations come to my mind.

The first is that successes in the battle against ISIS, both on the ground and in cyberspace, have led to a significant decline in the number of ISIS members communicating with persons in Canada. ISIS was indeed coming under very heavy pressure during the period covered by this data, although it hadn't yet lost its control over large parts of Syria and Iraq. However, recent reports suggest that ISIS is still engaged in extensive online organizing and recruiting activity. Moreover, the substantial overall increase in PCs collected (as opposed to used or retained) in 2016-17 also suggests that a decline in targeted traffic—whether ISIS-related or otherwise—is not the primary explanation.

The second possibility is that the nature of the traffic has been changing, such that it now contains a significantly lower proportion of PCs that are of intelligence interest. This might be a result of a decline in the number of new individuals in Canada interested in communicating with ISIS, for example. It seems unlikely, however, that ISIS traffic involving persons in Canada would still be growing substantially under such circumstances, and even more unlikely that the great majority of that traffic would be of no intelligence interest. A more plausible possibility along these lines, perhaps, is that CSE's collection priorities have started to shift dramatically towards non-ISIS targets of various kinds whose communications with persons in Canada contain a much lower proportion of intelligence-related traffic.

The third possibility is that we are beginning to see the effects of the spread of encrypted messaging in recent years. Telegram, launched in 2013, is reported to have been widely adopted by ISIS members and supporters by 2016, largely on account of the end-to-end encryption capabilities that users can choose to utilize in its Secret Chat function. WhatsApp, which currently has more than 1.5 billion users, finished implementation of end-to-end encryption by default for all users in April 2016. Other apps also have or are moving to adopt similar technologies to various degrees.

If monitoring of messaging apps does explain the great increase in the number of PCs used or retained between 2013-14 and 2015-16, then the subsequent spread of encryption on those apps might well explain much of the 70% drop in the number of PCs used or retained in 2016-17. Interestingly, and perhaps not entirely coincidentally, an RCMP document prepared in early 2018 asserted that "Approximately 70 per cent of all communications intercepted by CSIS and the RCMP are now encrypted".

If this third explanation is correct, then the increasingly widespread use of encryption in messaging apps is starting to have a significant effect on CSE SIGINT operations.

It doesn't necessarily follow that seeking to limit encryption or to mandate government backdoors would be an appropriate or effective response to this development, however. (For more on encryption policy, see Lex Gill, Tamir Israel, and Christopher Parsons, Shining a Light on the Encryption Debate: A Canadian Field Guide, Citizen Lab and the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic, May 2018.)

Even universal adoption of secure encryption isn't going to solve the much broader problem of cybersecurity, and for the same reason it isn't going to mean the end of SIGINT.

But it could certainly mean large changes in the focus of SIGINT activities, just as the Soviet adoption of highly secure encryption for their high-echelon communications in 1948 led to sweeping changes in the organization and activities of the UKUSA SIGINT agencies through the 1950s.

Of course, it is also conceivable that some combination of all three possibilities, and perhaps other factors, has played a role in the drop. It will be very interesting to see where the numbers go when the 2017-18 data is released in the forthcoming 2018-19 report. Will they go back up, implying the 2016-17 numbers were just a blip? Or will the decline continue, suggesting that encryption really is starting to bite?


Maybe time to release different data

It occurs to me that CSE might be less than entirely happy to see this kind of speculation bandied about in a public forum, even if it turns out to be wildly incorrect. But I don't have a lot of sympathy for the agency on this question.

What I and other CSE watchers in Canada are really interested in is how many Canadians and other persons in Canada end up with their communications collected by CSE, and how many of those have their communications featured in reports to CSE SIGINT clients.

The only reason we find ourselves (possibly) with some insight into the types of communications being monitored and whether encryption is having a significant effect is that the agency has been forcing us to work with an imperfect proxy, the number of PCs used or retained.

If CSE instead permitted OCSEC and in future NSIRA to report the number of Canadians/persons in Canada who feature in such reports, we'd have a number much more useful for privacy-tracking purposes and much less useful for speculating about communications methods and the consequences of encryption or even about the capabilities of CSE in general.

Given that this number would refer only to incidental collection and would not include targeted domestic monitoring under CSIS or RCMP warrants, is there really a credible argument that ISIS or Al Qaeda or the SVR or the GRU or the Chinese MSS etc, etc could look at that number—let's say it's 20—and draw some sort of useful conclusion as to whether or not its own particular contacts were being watched?

Ideally, such reporting should be expanded to include all Canadians/persons in Canada appearing in foreign intelligence reports, not just those resulting from CSE's own collection of PCs, and maybe also an additional number for Canadians/persons in Canada appearing in IT Security reports.

I suspect CSE would also benefit from this approach since the number of Canadians/persons in Canada appearing in SIGINT reporting is very likely quite low and would probably be highly reassuring to the Canadian public.

(Alternatively, if the number is actually quite a bit larger than we've been led to expect, such that the Canadian public might actually be somewhat shocked by it, then in my view it's long past time to admit that, explain the reasons that supposedly justify it, and earn an honest social license to operate instead of one based on deception. Personally, I doubt this is what has being going on, but if CSE would give us the numbers there would be much less room for dark speculations.)

Show us the numbers!

The New York Times recently reported (Nicole Perlroth, Jeff Larson & Scott Shane, "N.S.A. Able to Foil Basic Safeguards of Privacy on Web," New York Times, 5 September 2013) that

The National Security Agency is winning its long-running secret war on encryption, using supercomputers, technical trickery, court orders and behind-the-scenes persuasion to undermine the major tools protecting the privacy of everyday communications in the Internet age, according to newly disclosed documents.

Among other methods used by the agency,

the N.S.A. has been deliberately weakening the international encryption standards adopted by developers. One goal in the agency’s 2013 budget request was to “influence policies, standards and specifications for commercial public key technologies,” the most common encryption method.

Cryptographers have long suspected that the agency planted vulnerabilities in a standard adopted in 2006 by the National Institute of Standards and Technology and later by the International Organization for Standardization, which has 163 countries as members.

Classified N.S.A. memos appear to confirm that the fatal weakness, discovered by two Microsoft cryptographers in 2007, was engineered by the agency. The N.S.A. wrote the standard and aggressively pushed it on the international group, privately calling the effort “a challenge in finesse.”

“Eventually, N.S.A. became the sole editor,” the memo says.

Yesterday, the Times provided more details of how the NSA pushed the flawed standard forward (Nicole Perlroth, "Government Announces Steps to Restore Confidence on Encryption Standards," New York Times, 10 September 2013):

Internal N.S.A. memos describe how the agency subsequently worked behind the scenes to push the same standard on the International Organization for Standardization. “The road to developing this standard was smooth once the journey began,” one memo noted. “However, beginning the journey was a challenge in finesse.”

At the time, Canada’s Communications Security Establishment ran the standards process for the international organization, but classified documents describe how ultimately the N.S.A. seized control. “After some behind-the-scenes finessing with the head of the Canadian national delegation and with C.S.E., the stage was set for N.S.A. to submit a rewrite of the draft,” the memo notes. “Eventually, N.S.A. became the sole editor.”

One possible interpretation of this passage is that the naive Canadians were pwned by the crafty NSA delegation, whose real goals were unknown to the Canadians.

I don't subscribe to that interpretation. Much more likely, in my view, is that CSE and the NSA worked hand-in-glove to game the standards process.

None of which, perhaps, should be surprising.

But it's a useful reminder that when, for example, CSE "presents" a computer security conference that features talks like "Bypassing Security Controls with Mobile Devices" and provides associated training events like "Bypassing Security Defenses – Secret Penetration Testing Techniques", its goal is not always to make your computers and communications devices more secure.



[Update 12 September 2013: Jesse Brown takes up the story and gets a non-denial from CSE: Jesse Brown, "NSA says it ‘finessed’ Canada, seizing control of global crypto," Macleans.ca, 11 September 2013]

Recent news and commentary related to CSE or signals intelligence in general:

- Matthew Braga, "Canada Needs to Revive the Encryption Debate It Had in the 1990s," Motherboard, 26 April 2016.

- "Minister Sajjan delivers keynote address at the 2016 SINET IT Security Entrepreneurs Forum," Government of Canada news release, 20 April 2016. Text of the speech here. [Update 6 May 2016: I don't know where the Minister or his speechwriters got the idea that CSE has been around for "close to 75 years". CSE (then called CBNRC) was born on 1 September 1946, or close to 70 years ago.]

- Alex Boutilier, "Canada’s spies closely watching quantum tech developments," Toronto Star, 20 April 2016.

- Victoria Ahearn, "5 moments from The Good Wife’s visit to Toronto," Canadian Press, 18 April 2016. CSE makes a cameo appearance in the U.S. TV series The Good Wife. But they got the CSE badge wrong (HT to Justin Ling).



- Jordan Pearson & Justin Ling, "Exclusive: How Canadian Police Intercept and Read Encrypted BlackBerry Messages," Motherboard, 14 April 2016. See also Justin Ling & Jordan Pearson, "Exclusive: Canadian Police Obtained BlackBerry’s Global Decryption Key," Vice News, 14 April 2016; Jordan Pearson, "Canada Desperately Needs to Have a Public Debate About Encryption," Motherboard, 14 April 2016; and Justin Ling, "BlackBerry's CEO Won’t Answer Media Calls, Instead He Blogged About Cooperating With Canadian Cops," Vice News, 18 April 2016. Chen's blog post. CSE's March 2011 warning on the (in)security of Blackberry PIN-to-PIN messaging. Chris Parsons on the vulnerability of BlackBerry messages.

- Ben Makuch, "The 'Darth Vader' of Cyberwar Sold Services to Canada," Vice News, 11 April 2016.

- "Spy Shit," Canadaland podcast episode 129, 10 April 2016. Matt Braga and Jesse Brown discuss "the Panama Papers, CSIS, C-51, and Ben Makuch's ongoing battle with the RCMP". Well worth a listen, but the statement (at about 13:50) that the CSE Commissioner has never declared CSE in violation of the law is not correct.

- Leslie Young, "Former CSIS head Richard Fadden says Canada could someday carry out cyber attacks," Global News, 6 April 2016. More here.

- Sunny Dhillon, "Edward Snowden's talk in Vancouver had an 'electric quality'," Globe and Mail, 6 April 2016.

- Ron Deibert, "My conversation with Edward Snowden," Ronald Deibert blog, 3 April 2016. Video here: "Fireside Chat: Ron Deibert, Edward Snowden & Amie Stephanovich," RightsCon, 1 April 2016. Interesting Snowden comment: "It's true, [CSE's] oversight is hideous, because it was never really thought about. But there's a reason for that. In my experience of the Five Eyes, the Canadian intelligence services were always the least aggressive, they were the least adventurous, they didn't really push the legal boundaries. It was difficult to target Canadians, legally and so on and so forth, for surveillance. And it wasn't until the recent government—I'm not Canadian so I'm not going to name [garbled], I believe it was the Harper government—that things really started to change and oversight became much more important because they became much more aggressive in a short period of time."

- Alex Boutilier, "Canada’s spy agencies looking to work together more, say top secret documents," Toronto Star, 2 April 2016.

- Jim Bronskill, "Government instructions to CSIS on bill C-51 to remain largely secret," Canadian Press, 27 March 2016.

- Jim Bronskill, "Federal agencies sharing information under Bill C-51 provisions," Canadian Press, 24 March 2016.

-Ian MacLeod, "Spy agency watchdog ‘in a difficult position’ with huge budget cuts looming," Ottawa Citizen, 24 March 2016. Possibly a sign the government is planning a major overhaul of the various review agencies?

- Colin Freeze, "RCMP, CSIS see no significant support for operations from federal budget," Globe and Mail, 23 March 2016.

- Colin Freeze, "B.C. multimillionaire pleads guilty to hacking into U.S. military for China," Globe and Mail, 22 March 2016.

- Kyle Matthews & Chantalle Gonzalez, "Our mission against ISIL has one major flaw — it ignores the Internet," National Post, 22 March 2016.

- Dylan Robertson, "Canada Doubles Spending on Counter-Radicalization," Vice News, 22 March 2016.

- Matthew Braga & Colin Freeze, "Agencies did not get federal authorization to use surveillance devices," Globe and Mail, 11 March 2016.

- Emma Loop, "The Drone And The Damage Done: How Canada’s UAV Operation Wounded Its Own," Buzzfeed, 16 March 2016.

- Karen DeYoung, "Canada to boost its advise-and-train mission, intelligence capabilities in Iraq," Washington Post, 11 March 2016.

- B.C. Civil Liberties Association et al., "The necessary components of an effective and integrated national security accountability framework for Canada," 9 March 2016.

- Susan Lunn, "Ralph Goodale says Ukraine cyberattack caused 'international anxiety'," CBC News, 8 March 2016.

- Alex Boutilier, "Cyber security review still in early days, Public Security officials tell Senate," Toronto Star, 7 March 2016.

- Peter Zimonjic, "CSIS head says new powers to disrupt plots used almost 2 dozen times," CBC News, 7 March 2016.

- Colin Freeze, "Documents reveal CSIS wary of Bill C-51 reforms," Globe and Mail, 3 March 2016. The documents.

- David Christopher, "Adopting the UK model won't be enough for Ralph Goodale to address Canada's spy oversight woes," OpenMedia, 26 February 2016.

- Editorial, "Give Parliament the power to scrutinize spy agencies," Toronto Star, 24 February 2016. Response from CSE Chief Greta Bossenmaier.

- Matthew Braga, "Why Canada isn’t having a policy debate over encryption," Globe and Mail, 23 February 2016.

- Alex Boutilier, "Canada’s spies expecting a budget boost," Toronto Star, 23 February 2016. More on CSE's budget here.

- Amanda Connolly, "‘It’s impossible’ to know impact of CSE metadata glitch: commissioner," iPolitics, 22 February 2016. More here.

- Alex Boutilier, "CSE can assist in ‘threat reduction’ without a warrant, documents show," Toronto Star, 20 February 2016.

- Daniel Lang, "Why don't we charge more people with terrorism?" Toronto Sun, 19 February 2016.

- Lucas Powers, "Apple's encryption battle with the FBI could spill into Canada," CBC News, 19 February 2016.

- Bruce Campion-Smith, "Canada’s spy agency CSIS gears up for expanded role in Islamic State fight," Toronto Star, 18 February 2016.

- Luc Portelance & Ray Boisvert, "It’s time for Canada to get serious about national security," National Post, 16 February 2016. See also Stewart Bell, "Canadian security agencies under strain while threats have ‘seldom been so high,’ former senior officials say," National Post, 16 February 2016.


Also of interest: CSE now has a twitter feed. Maybe this is what the Minister had in mind when he said he has "directed CSE to find new opportunities to communicate with the public more openly about their activities." I can't say it has done much to demystify the place so far. I have a suggestion that I've made in the past, but which I think bears repeating. How about reinstating the degree of public reporting that existed prior to November 2011, when CSE became a stand-alone agency?

Do "old" opportunities not count?


SIGINT history:

The word on the grapevine is that CSE, in a fit of brainlessness some time ago, destroyed the only copies of A History of the Examination Unit: 1941-1945, Gilbert Robinson's July 1945 history of Canada's first cryptanalytic organization. If true, the significantly redacted but still somewhat useful version released many years ago under the Access to Information Act, preserved by me and presumably some other folks, may be all we have left. I'd be very pleased to report that this is not true and the document does still exist in its complete form.

Update 11 November 2016: I'm happy to say that apparently it isn't true: the history does still exist in intact form. Thank goodness! It would be nice to see a more complete version made public.

Update 25 May 2022: Here it is, entirely unredacted.

Some recent commentaries on CSE, surveillance, and privacy:

Michael Geist, "Canada complicit in undermining Internet privacy: Geist," Toronto Star, 13 September 2013

As the tidal wave of disclosures on widespread U.S. surveillance continues - there is now little doubt that the U.S. government has spent billions creating a surveillance infrastructure that covers virtually all Internet and wireless communications - the question of Canada’s role in these initiatives remains largely shrouded in secrecy.

The Canadian government has said little, but numerous reports suggest that agencies such as the Communications Security Establishment Canada (the CSE is the Canadian counterpart to the U.S. National Security Agency) are engaged in similar kinds of surveillance. This includes capturing metadata of Internet and wireless communications and working actively with foreign intelligence agencies to swap information obtained through the data mining of Internet-based surveillance.

The active connection between Canadian and U.S. officials moved to the forefront last week with reports that Canadian officials may have played a starring role in facilitating U.S. efforts to create a “backdoor” to widely used encryption standards. That initiative has been described as “undermining the very fabric of the Internet.”

Ron Deibert, "To protect Canadians' privacy, telcos must shut the 'back door'," Globe and Mail, 16 September 2013

Recently leaked Edward Snowden documents reveal the U.S. National Security Agency, in its quest to vacuum as much digital data as possible, has been compelling communications companies to build secret vulnerabilities into their systems, otherwise known as “back doors.” These special methods of bypassing normal authentication procedures to secretly access encrypted communications are known only to the companies that build them and the NSA agents that have access to them. Not surprisingly they prefer to keep such dalliances hidden in the dark.

Given Canada’s special relationship with our cousins south of the border, it should come as no surprise that our own security agencies also prefer the back door. According to The Globe and Mail, “for nearly two decades, Ottawa officials have told telecommunications companies that one of the conditions of obtaining a licence to use wireless spectrum is to provide government with the capability to bug the devices that use the spectrum.” Documents obtained by The Globe also reveal that as part of these requirements, Ottawa has demanded companies scramble encryption so that it can be accessed by Canada’s law enforcement agencies – encryption that protects our intimate conversations, banking transactions, transmission of health and financial records, and so on. Remarkably, Ottawa deems such requirements too sensitive to be shared with the public. ...

The back door approach is symptomatic of a larger trend, and a particular approach to securing cyberspace prominent today that privileges intelligence and security agencies over other stakeholders, designs security through obscurity, and undermines checks and balances around government.

Law enforcement and intelligence agencies are necessary and important to liberal democracy, but there is more than one way for them to go about their missions. In the world of Big Data, in which so much personal information is readily available, new methods of “connecting the dots” must be explored other than those that drill holes into our communications infrastructure from the inside out and leave users dependent on the digital equivalent of Swiss cheese. Government surveillance needs re-thinking today, beginning with a loud and clear call to “shut the back door!”

Ann Cavoukian, Ron Deibert, Andrew Clement & Nathalie Des Rosiers, "Real privacy means oversight," Globe and Mail, 16 September 2013

In democratic societies, governments must be accessible and transparent to their citizens. And individuals must be free to make informed choices about what personal details to reveal about their lives. Governments are permitted to access personal information only when authorized by law. When it comes to the state's power to conduct surveillance, critical privacy protections must include independent oversight.

While there is much criticism of the U.S. Foreign Intelligence Surveillance Court, at least it has oversight of NSA activities. There is no equivalent in Canada. CSEC's operations rely on ministerial approval, with little transparency or accountability. Canadians know startlingly little about what our government is doing - and, potentially, what foreign intelligence agencies are doing - with their personal information. It is disturbing that there's been so little debate on this important issue, even in Parliament.

CSEC's only meaningful accountability rests on a single annual review undertaken by a single individual - woefully inadequate. In his report this summer, CSEC Commissioner Robert Décary, a retired judge, issued a rare public critique, acknowledging that he'd been unable to reach a definitive conclusion about the agency's compliance or non-compliance with the law for various foreign signals intelligence activities. Some activities, he said, "may have been directed at Canadians, contrary to the law."

CSEC, and the government, must account for what's taken place. Canadians rightly deserve answers on the scope of domestic spying powers. How much will we allow in the name of security and public safety? There is no question that some measures are necessary to counter terrorism, but must they always be at the exclusion of privacy? We say no.

There can be little doubt that surveillance is a global issue, with personal information being shared across jurisdictions, sometimes in a manner that contravenes the most basic principles of privacy and freedom. We must engage citizens so the message of "respect our privacy, respect our freedoms," can be heard, loud and clear. In a free and open society, we deserve no less.

David Lyon, "Can citizens roll back silent army of watchers?" Toronto Star, 23 September 2013

...[A]sking questions is long overdue. Fears fanned by 9/11 “security” and the fun fostered by Facebook distracts us from what’s really going on: the surveillance playing field now tilts perilously in favour of large organizations and away from individuals and groups. Such surveillance undermines our relationship as citizens to the state — we may naively comply but we didn’t consent. ...

Who will ask these questions and more? It isn’t just a matter of “catching up” with new technology, although recognizing that Canadian law lags pathetically behind reality would be a start. It’s also about why technological potential is permitted to become political destiny, why everyone has become a suspect and why organizations are so resistant to calls for accountability for sensitive personal information.

Canada, blessed with much better personal data protection than many other countries and a long history of innovative thinking about communications, could still take the lead in reversing the trend toward unwarranted and disproportionate surveillance. The so-called digital era is not self-propelling, nor is it inevitably destructive of trust or care for vulnerable groups.

It’s up to us to keep up the pressure for answers and, more important, for public debate on surveillance today. There’s already a palpable groundswell. One key site for information is SecretSpying.ca.

In the era before weather satellites, access to information about weather conditions in adversary-controlled areas could be highly valuable. Such information could be used to determine the likelihood of hostile military activities in those areas, to support friendly military activities in or near those areas, and to provide data for future weather forecasts in other parts of the region. Since weather data was often sent to adversary military forces as part of their routine encrypted communications, such information could also provide a "probable plain text" clue that might prove useful in breaking into certain of those encryption systems.

For these reasons, during the Second World War and the Cold War, reports from adversary weather stations were themselves often encrypted, and they were the target of SIGINT collection and codebreaking activities. Within the UKUSA community, intelligence derived from collection of weather station reports was known as Special Weather Intelligence.

The Friedman documents released by the NSA earlier this year contain some interesting insight into Canada's access to Special Weather Intelligence related to the Far East acquired by NSA and GCHQ.

This document reports that although Canada did not originally foresee a need for more than Summaries of such material,

On 23 December 1953, Hq, USAF, Directorate of Intelligence (a) informed [NSA] that the RCAF is ready to receive such [redacted] as is now available from the [redacted], and (b) suggested that the Director, NSA, make arrangements with the RCAF to furnish materials to RCAF Headquarters via the NSA/CBNRC communications link. Accordingly, arrangements have been completed for this channel to be used carrying information prepared by [redacted] from the products of the [redacted.] It would appear that the Canadian requirements for codeword [redacted] have expanded beyond [redacted] Summaries.

The parts of the document that confirm that the subject of this discussion was Special Weather Intelligence have all been redacted, unfortunately, but this other Friedman document helpfully fills in the most important blank, informing us that the title of the first document is "US/UK/CAN Tripartite Arrangements Concerning Far East Special Weather Intelligence" (see entry for USCIB 1.1/1 on page 62).

And these two documents confirm that

On 15 May 1954, LSIB, CRC and USCIB recognized that Canada's peacetime requirements for [redacted] Intelligence bearing codewords had increased subsequent to the Tripartite Conference of March 1953. LSIB, CRC and USCIB therefore agreed that such codeword materials as are required by any of the three parties should be requested under the regular procedures already established for requesting all other types of COMINT codeword material.

(LSIB, CRC, and USCIB were the London Signals Intelligence Board, the Communications Research Committee, and the United States Communications Intelligence Board, the U.K., Canadian, and U.S. interdepartmental committees respectively in charge of GCHQ, CBNRC, and NSA.)

It is interesting to speculate about what may have changed between March 1953 and December 1953 to cause Canada, and the RCAF in particular, to require greater access to Far East Special Weather Intelligence.

Canadian Army and Royal Canadian Navy units took part in the Korean War, and RCAF transport aircraft operated between North America and Korea during the war, but the fighting had been over for nearly five months by the time the RCAF reported it was "ready to receive" expanded access, and by nearly ten months by the time the expanded access actually began. Furthermore, the tripartite statement approving that expanded access described it explicitly as a "peacetime" requirement. It seems highly unlikely, therefore, that the RCAF's need was related to the Korean War.

One possibility is that the RCAF wanted access to the information to help it plan North American early warning and air defence operations with the USAF. (The Far East includes the eastern part of the Soviet Union, which would have been the source of many of the aircraft taking part in an attack on North America.)

Another possibility is that the RCAF wanted the data in support of its own planned operations in the Arctic. In September 1953, the RCAF decided to convert three photo reconnaissance/aerial mapping variants of the Lancaster bomber to an Arctic reconnaissance configuration. According to one source, some of the missions flown by the aircraft involved "ECM patrol in the ocean area well north of the Queen Elizabeth Archipelago, carrying out a listening watch for Soviet electronic emissions." The first mission with the newly converted aircraft was flown in September 1954.

Neither theory (air defence or Arctic reconnaissance) explains why the RCAF's request was limited specifically to Far East Special Weather Intelligence, however. Perhaps Canada already had access to weather intelligence for other regions in the North.

This webpage on the Soviet M-130 Koralle encryption machine discusses the use of encryption for Soviet and Soviet Bloc weather data. However, according to the authors, the M-130 was introduced in 1965, so evidently this machine was not used during the 1950s.


Update 1 January 2016: For more on weather intelligence, see Jeffrey T. Richelson, "Weather or Not," Air Force Magazine, October 2013.

Der Spiegel published a new CSE slide deck on Sunday (part of a large dump of Snowden documents) in conjunction with a story discussing Five Eyes efforts to defeat common encryption methods used on the Internet (Jacob Appelbaum, Aaron Gibson, Christian Grothoff, Andy Müller-Maguhn, Laura Poitras, Michael Sontheimer & Christian Stöcker, "Prying Eyes: Inside the NSA's War on Internet Security," Der Spiegel, 28 December 2014).

The CSE deck, undated but probably from 2012, is titled "TLS Trends: A roundtable discussion on current usage and future directions".

The TLS in question is Transport Layer Security, the latest version of the Secure Sockets Layer protocol that provides encryption for many "secure" web transactions.

Der Spiegel (and other commentators) drew special attention to page 13 of the slides, which purports to list target activity at hockeytalk.com:

Canada's Communications Security Establishment (CSEC) even monitors sites devoted to the country's national pastime: "We have noticed a large increase in chat activity on the hockeytalk sites. This is likely due to the beginning of playoff season," it says in one presentation.

If on-line game chat rooms are sometimes monitored, then I suppose it's not impossible that Hockeytalk is also considered a possible location for communications that may have nothing to do with hockey.

But, really, this sounds more like a made-up example to me, along the lines of Pte. Bloggs and the Fantasians, than a real case.

Of greater interest to me is the frequent use of the word "warranted" in the presentation. As CSE does not obtain warrants for its foreign intelligence and cyber defence operations, this sounds like a reference to "Mandate C" operations, which CSE conducts in support of CSIS and the RCMP (and a few other agencies) and which entail the deliberate (but targeted) surveillance of Canadians or other persons in Canada.

[Update 7 January 2015: An additional possibility is that some of this material is foreign intelligence collected in Canada under warrants that CSIS obtains through section 16 of the CSIS Act.]

[Update 29 December 2014, 7:30 pm: A report in VICE (Patrick McGuire, "We Learned Very Little about Canada’s Cybersurveillance Agency, CSEC, in 2014," VICE, 29 December 2014) also concludes that the Hockeytalk reference was intended to be humourous. An update to the article reports that CSE spokesperson Ryan Foreman assured VICE that the Hockeytalk slide was "obviously fictitious content", adding that "CSE is prohibited by law from directing its foreign intelligence or cyber defence activities at Canadians anywhere in the world or at anyone in Canada."

If there's one thing that we didn't need to learn about CSE in 2014, because we already ought to have known it, it's that they always neglect to mention Mandate C.]

Canada also comes in for a mention in another document released by Der Spiegel, this one describing a German operation against a Taliban commander/narcotics trafficker in Afghanistan that was supported by SIGINT analysts at NSA Georgia (NSAG):

Near-real-time locational data on [redacted] was passed from NSAG to the Germans via the Coalition’s CENTER ICE system.... The use of CENTER ICE was critical to the success of this operation. At NSAG CENTER ICE was manned by a Canadian integree within the Coalition Support Cell. Of note, this was the first time that CENTER ICE has been used at NSAG to support a live operation, in addition to the first time the Germans have used CENTER ICE for coordination such as this.

"CENTER ICE was manned by a Canadian integree..."

There's that hockey thing again!

The Canadian Forces Information Operations Group, the military arm of the Canadian SIGINT community, has a detachment of around 10 personnel working at NSA Georgia.

Here's a summary version of the talk I gave at the University of Ottawa on November 23rd (an updated and somewhat expanded version of the presentation I made at Laval University in October):

The Communications Security Establishment: What do we know? What do we need to know?



Some of the people here today know a great deal about the Communications Security Establishment, but it is likely that a lot of you do not know a lot about it, so I'd like to begin with some background information about the role, origins, and evolution of the agency. I’ll then describe what we know and don’t know about whether CSE monitors Canadians in the course of its operations. Finally, I’ll wrap up with some suggestions on how to improve transparency about CSE and its operations.


CSE is Canada’s national cryptologic agency. It has two programs: SIGINT and ITSEC.

(The photo shows the Edward Drake Building, CSE's new headquarters. Source.)

The agency has a three-part mandate laid out in the National Defence Act.



The SIGINT program addresses all three elements of CSE's mandate and accounts for about $435 million of the agency's $605 million budget for FY 2016-17, while the ITSEC program is focused on Mandate B and accounts for about $170 million.



The agency recently celebrated its 70th birthday, but its origins lie in the signals intelligence co-operation initiated between the Western allies during the Second World War.


(CSE's first headquarters was located on the third floor of the La Salle Academy, a Catholic boys school in downtown Ottawa, shown on the left. The facility had previously been occupied by one of CSE's wartime predecessor organizations, the Joint Discrimination Unit.)

Although Canada was a very small player in Second World War SIGINT, it participated in the planning that allocated intercept and processing tasks among the allies and shared in the intelligence output. This deep integration of SIGINT activities laid the foundations for the very close co-operation that has persisted to the present.



Lt-Col Ed Drake is circled in red in this photo from a 1944 planning conference. (Source.) Five other Canadians and the British cryptanalyst supplied to Canada to run the Examination Unit (the civilian in the back row) are also in the photo.



The U.S. and U.K. agreed to continue SIGINT cooperation into the post-war era even before the war ended, with the new primary target to be the Soviet Union. The BRUSA (later renamed UKUSA) agreement, the founding document of the post-war partnership, was negotiated in the fall of 1945 and signed on 5 March 1946. Canada and the other Dominions of the British Empire were not signatories of the agreement, but provision for their participation was written into it.



By the time CSE, known originally as the Communications Branch of the NRC, was formally established on 1 September 1946, its position as junior member of a multinational SIGINT conglomerate had thus already been determined.

The CBNRC was transferred to the Department of National Defence and renamed the Communications Security Establishment on 1 April 1975. In November 2011 it became a stand-alone agency, still under the Minister of National Defence but no longer a part of the department.

The radio intercept stations that supplied CBNRC/CSE are operated by the military, currently the Canadian Forces Information Operations Group.

Oh, and there's Ed Drake again.



We turn now to an extremely abbreviated history of the organization:

There was a Cold War, during most of which CSE focused almost exclusively on the Soviet Union.



Then the Cold War ended, and CSE found new targets, principally diplomatic and economic.



And then this happened, and CSE's focus shifted once again.



Which brings us up to the present.

Since 9/11, counter-terrorism has been CSE's top priority, with Support to Military Operations also of increased importance.

The advent of the Internet also had a dramatic effect on the agency's operations, opening whole new avenues for SIGINT operations, including Computer Network Exploitation activities to access "data at rest" on target computer systems.



The post-9/11 era saw the greatest period of growth in CSE's history. Now apparently stabilized at a staff of about 2100–2200, CSE has 2.3 times as many employees as it had prior to 9/11 and 3.5 times as many as it had through most of the Cold War.



Its budget has also grown dramatically since 9/11. At $605 million in FY 2016-17, CSE's current budget is 4.5 times as high in inflation-adjusted dollars as its pre-9/11 budget. (The spike to nearly $900 million in 2014-15 was the result of a one-time $300 million payment made when the agency's new headquarters was completed.) By comparison, CSIS’s $594 million budget is 2.6 times as high as its pre-9/11 budget.



Canada's legacy radio intercept stations—Alert, Gander, Masset, and Leitrim— are still in operation, the first three now operated remotely from Leitrim...



...but the real SIGINT action now takes place in cyberspace. (Source.)



A lot of current SIGINT collection is “special source” collection – obtained by tapping the traffic carried on the fibre optic cables and high-speed routers that form the physical infrastructure of cyberspace, sometimes with, sometimes without the cooperation of the companies that own and operate it. This graphic shows just one company’s worldwide network.



The Internet quickly became the primary hunting ground of CSE and its SIGINT partners, and they undertook to Master the Internet.



According to CSE, the shift towards the Internet as hunting ground has actually increased the importance of the Five Eyes partnership.



CSE’s dependence on its allies, and in particular on the U.S., makes the election of Donald Trump – already potentially huge for Canadian foreign and defence policy – even more significant. If President Trump does even half of the things he has promised (torture, war crimes, mass surveillance…) it will represent a crisis for intelligence-sharing with the U.S.



I don’t have a detailed set of suggestions for how Canada might respond, but at a minimum we would have to revisit CSE's Ministerial Directive on Framework for Addressing Risks in Sharing Information with Foreign Entities, which currently excludes Canada’s Five Eyes partners.

Another aspect of the global nature of Internet traffic is that mixed in among the traffic that CSE and its allies seek to monitor is the Internet traffic of Canadians.



(This graphic depicts the undersea fibre optic cables that carry a large proportion of the world’s Internet traffic. Source.)

The intermingling of Canadian Internet traffic with that of the rest of the world means that CSE encounters Canadian communications even when it is trying not to do so. And this raises an important question: Does CSE monitor Canadians?



I have three answers to that question.



The first answer is the one you usually get from CSE or government ministers and members of parliament—often these exact words. This prohibition is indeed written into the National Defence Act, not this precise formulation, but words to the same effect.



However, there are several important exceptions to this absolute-sounding rule:



First, the rule prohibits only activities "directed at" specific Canadians or persons in Canada. Thus, for example, bulk collection of metadata, because it is not collected with any specific target in mind, is permitted—even if, as in the "Airport wi-fi" case, all of the metadata in question relates to persons in Canada.

"Incidental" collection of Canadian communications (collected when one of CSE's foreign targets communicates with a Canadian) is also permitted.

Targeted collection of Canadian communications is permitted under Mandate C (i.e., when a federal law enforcement or security agency requests such collection and has lawful authority for the request).

Finally, CSE is permitted to receive Canadian communications collected and forwarded by its SIGINT allies, although it is not permitted to request the targeting of Canadians. CSE recently formalized procedures for providing such intercepts to CSIS.

None of these exceptions opens the door to unlimited mass surveillance of all Canadians, and such information as we have suggests that the amount of Canadian-related information collected by CSE is, with the exception of metadata, mostly very limited.

But the information we have is itself very incomplete, and a surprisingly large amount of legal surveillance could be hidden behind the details that remain redacted.



This leads to my third answer: We don't know.



We don't know the full meaning of "directed at" as the government understands the term. CSE modified its activities following a 2012 court case that rejected an attempt by CSIS to broaden the meaning of the term, which suggests that, at that time at least, CSE was operating with an excessively permissive understanding of its meaning.



An unknown amount of activity could also be underway to analyze metadata or other non-content data on behalf of CSIS or the RCMP. Such processing might fall beneath the threshold considered to require a judicial warrant, and thus would be subject to much less stringent limits. Canadian communications that are not considered "private communications" under the Criminal Code might also be subject to looser rules.



The potential for larger-than-realized access to Canadian-related information through allied collection and sharing also needs to be recognized.



Finally, it might also be questioned whether CSE actually obeys the various rules that limit the extent to which it is legally permitted to monitor Canadians.

This leads to my next question: Does CSE obey the law?



I have four answers to this question.



The notable exception occurred in 2015 when the CSE Commissioner declared CSE in violation of the law. (The decision was reported to the public in 2016).



The complications arise because not every instance in which CSE fails or may have failed to follow legal requirements is assessed by the Commissioner as formal non-compliance (see my somewhat tongue in cheek discussion here).



Here's the short explanation of that.



It's worth noting that these are mostly fairly minor incidents. There's no systematic program of monitoring Canadians hiding among these items, although some of the disagreements over legal interpretations do touch on CSE's core activities.

Over the years, CSE Commissioners have recommended a long list of amendments that would clear up these interpretation issues and place CSE on a sounder legal footing. The government promised action on a number of amendments as long ago as 2007, but nine years later we're still waiting.

A broader question relates to uncertainties in the proper interpretation of the laws that pertain to CSE's activities. In this respect, not even CSE really knows if it obeys the law. In many cases, the courts have simply not addressed these questions.

This could change as a result of the BCCLA and CCLA court challenges currently underway.



My final thought with respect to CSE and the law is, why wouldn't we expect it obey the law (at least, as the agency understands it)?

There is every reason to believe that compliance with the law is a fundamental part of CSE's ethos, and if the government wanted the agency to do something not currently legal, it could probably manage to make it legal. It's the government that writes the laws after all, although that power is somewhat checked by the courts.

The question of whether the government will grant itself additional "lawful access" powers is currently back on the parliamentary agenda.



The question of compliance with the law is certainly important.

But, for me, the greater concern is what's being done, or could be done, entirely within the law. Is the line that defines activities permitted by the law in the right place?

It may be that CSE's activities related to Canadians are comparatively minor and tightly constrained. But they might also be quite a lot larger than the information that is currently public suggests. We just don't know.

And the potential for excessive, intrusive surveillance will only grow in the future.



Which leads to my final question: How can we protect Canadians?



I don't have a lot of answers to this question.

But I don't think we can rely on "sunny ways".


(The photo shows Prime Minister Trudeau addressing CSE employees at the Edward Drake Building in June 2016. To the best of my knowledge, this was the first time a prime minister visited CSE.)

[Update 12 February 2017: Actually, John Diefenbaker visited the agency in October 1959.]

A number of proposals have been made to improve the oversight/review mechanisms and reform the legal regime pertaining to CSE and other members of the Canadian intelligence community.



But other people in this room could describe the merits of these proposals much better than I could.

Instead, I would like to focus the remaining portion of this talk on possibilities for increasing transparency around CSE and its activities.

Greater transparency would be useful not only to create a more informed public, but also to maintain the "social license" that CSE and other elements of the Canadian intelligence community need in order to operate.



CSE’s minister agrees with me that greater transparency is desirable.



However, the main change so far has been the creation of a CSE Twitter account.

I have a short list of other suggestions.



Parliamentary testimony is one of the only sources of information about CSE plans, policies, and operations.



But it has been of very limited usefulness so far.

Parliamentarians are rarely informed enough to ask good questions; government members mostly spend their time trying to make the government look good; and testimony takes place in open sessions, so CSE witnesses are very limited in what they are willing to say.

Even when questions are good, the answers may be less than satisfactory.



This question by MP Elaine Michaud is a good example. In his answer, CSE Chief John Forster wouldn't even confirm that metadata sharing takes place. As it turns out, this question was asked on the very day that CSE suspended its Internet metadata sharing with its Five Eyes partners as a result of the minimization problem.

But Forster certainly wasn't going to talk about that. Defence Minister Nicholson, who was sitting beside him, hadn't even been told yet, and this wouldn't have been the best way for him to find out.

The Committee of Parliamentarians proposed in Bill C-22 is likely to improve this situation somewhat. But the government's proposal has serious limitations. And if most of the committee's sessions end up in camera, the public may end up learning even less than now.

The government should commit to establishing a properly informed committee and ensure the maximum possible availability of information to the public.



Bottom line: Parliamentary testimony is a limited source of transparency. It might get better in the future, but it might get worse.



Proactive disclosure: CSE was exempted from the government’s proactive disclosure policy.



One could dispute aspects of that decision, but that's not my primary concern here.

I am more interested in other information that CSE could choose to make available proactively. CSE does do this occasionally, notably on its website, but it could do much, much more.



For example, this kind of Questions and Answers document, prepared to help the CSE Chief answer possible questions during testimony, could be routinely released.

Many historical documents, such as the Canada-U.S. CANUSA Agreement, could also be proactively released. The U.S.-U.K. equivalent of the CANUSA Agreement, the UKUSA Agreement, was declassified and posted on the web in 2010.



This CANUSA appendix was released by NSA, apparently by mistake, in 2015, but the rest of the CANUSA agreement remains inexplicably unreleased.

[Update 23 April 2017: The CANUSA Agreement was finally released in April 2017 following an Access to Information request.]



Bottom line: Proactive disclosure could be greatly improved.



Access to Information (ATI) responses: ATI responses can be quite useful, but most are very heavily redacted.



We get a lot of this sort of thing, or worse – it's not unusual to see page after page entirely blanked out. Some of this is justified, of course. CSE does have legitimate secrets that it needs to keep.



But sometimes there is no justification for the redaction at all. In this example, we eventually did find out what was redacted from this recommendation made by the CSE Commissioner.



Here’s what it said.

The implication that CSE may not have been ensuring that its decisions and activities were based on consistently applied and statutorily defensible criteria is embarrassing to the agency, yes, but there was absolutely no national security justification for withholding this information.

No one knows how often this kind of entirely unjustified, and probably unlawful, redaction is made.



Bottom line: ATI responses are an important source of information, but there is much room for improvement.



Annual Report: CSE could publish a voluntary annual report (like CSIS does), and also an annual Departmental Performance Report or equivalent. Such information used to be reported in the DND Departmental Performance Report.



This example from DND's 2001-02 Departmental Performance Report was 3 pages long. It included budget figures broken down into salary & personnel, operations & maintenance, and capital. Staffing numbers were provided. The section also contained explanatory text on CSE's plans and priorities.

This detailed reporting all stopped in 2011 when CSE became a stand-alone agency. There is no CSE Departmental Performance Report, and no formal or informal annual report.

No justification has ever been provided as to why this information can no longer be released. Basic budget figures are still reported in Main Estimates and the annual Public Accounts of Canada publications, but detailed information is no longer provided.



Bottom line: Transparency has almost entirely disappeared in this respect.



Estimates, Part III (Report on Plans and Priorities): Similar information also used to be reported in a 1- to 2-page section of the DND Report on Plans and Priorities.



This example from the 2004-05 RPP showed planned spending not only for the coming year but for each of the 2 following years as well. The figures were again broken down into salary & personnel, operations & maintenance, and capital. Additional explanatory information was provided.

This RPP reporting also ended when CSE became a stand-alone agency. Capital spending numbers are no longer available anywhere.



Bottom line: Transparency has almost entirely disappeared here as well. Again without any justification provided.



Staff numbers: Until February 2016, updated staff numbers were published every month for all departments and agencies of the government, including CSE. This practice has now stopped.



In February 2016, CSE had 2136 employees. Staffing information is no longer published anywhere.



Bottom line: CSE has gone entirely dark on this subject. Why can’t CSE publish these numbers itself?



Finally, there's the OCSEC annual report: CSE has no formal censorship power over the contents of this report, but it does have control over the classification and declassification of information, which gives it very significant de facto censorship power. CSE can't stop the Commissioner from talking about a particular subject, but it can certainly reduce his comments to barely comprehensible gibberish.



When the rate at which CSE used or retained Canadian private communications collected under its Mandate A went up 4410% last year, this was all the explanation the Commissioner could give.

Allowing the Commissioner to make more complete and detailed explanations would substantially increase the value of those reports, and probably serve to reduce the level of suspicion many Canadians feel about CSE.

Although there is excessive secrecy in the U.S. as well as in Canada, in most respects the U.S. provides much more detailed information about NSA operations than Canada does about CSE.



See, for example, this information about U.S. identities in SIGINT reporting. (Source: Statistical Transparency Report Regarding Use of National Security Authorities - Annual Statistics for Calendar Year 2015, May 2, 2016.)

Why can’t Canada at least meet this standard of transparency? Or indeed even go beyond it?

CSE should permit the release of much more information by OCSEC, including regular, detailed statistical information on the extent to which Canadian information is collected, processed, analyzed, and disseminated by or through CSE, including, for example, the number of Canadian identities (suppressed and unsuppressed) in CSE and allied reports issued during the year, the number of suppressed identities requested, and the number of identities revealed. Such data could be reported annually by OCSEC or by CSE through direct disclosure.



Bottom line: The information provided by OCSEC reports has been gradually increasing over the years, but major improvements are possible.



In all of these ways, CSE could increase transparency about its activities while still protecting necessary secrets. This would benefit both CSE and the Canadian public.

Thank you.

(End of presentation.)


And there you have it.

I went on for quite a bit longer than I probably should have, but my impression was that the talk was very well received.

CSE Deputy Chief (Policy and Communications) Dominic Rochon, who attended as a sort of respondent, sat through my extended harangue with very good grace. In the end he didn't directly address much of its content (in part no doubt because I left him little time), but he did acknowledge that CSE could do more to improve transparency about the agency. He promised specifically to look into releasing staff numbers.

His attendance at the event was itself arguably a step towards greater transparency. I thank him for participating.

My thanks also to everyone else who attended.

I also owe thanks to Professor Wesley Wark for inviting me to Ottawa to give the talk and to the staff at the University of Ottawa's Centre for International Policy Studies for organizing it.

Wesley and I have corresponded off and on for the last 25 years or so, but this was the first time we actually met.

I also had the great pleasure of meeting for the first time a number of other people I have worked with or shared information with over the years (in at least one other case, decades).

I obviously need to get out more often.


Update 29 November 2016: A couple of other points worth mentioning from Mr. Rochon's responses:

- CSE does not share the metadata it collects with other Canadian agencies, but certain CSE analytical work using metadata is shared with those agencies in the form of end-product reports.

- Except in certain cases, requests to CSE to reveal Canadian identity information that has been "suppressed" in CSE reports do not require a warrant.

- CSE does not support the idea of requiring a back-door in encryption systems.


Update 4 December 2016: A PDF document with the full set of PowerPoint slides is available here.