Communications Security Establishment Canada (CSEC) illegally spied on Canadians; Harper government insisted CSEC never spied on Canadians; Spy agency’s work with CSIS, RCMP fuels fears of privacy breaches

Canada’s spy agency faces tough questioning over snooping, CSEC accused of digitally tracked Canadians through free Wi-Fi zones by Jordan Press, PostMedia News, January 31, 2014, Calgary Herald
Canada’s super-secret cyberspy agency will be on the hot seat Monday, expected to face tough questioning from the Senate’s defence committee after revelations it allegedly spied and digitally tracked Canadians through free Wi-Fi zones in major airports. It is not only the Communications Security Establishment Canada (CSEC) chief John Forster that will face tough questions. CSIS director Michel Coulombe and Prime Minister Stephen Harper’s national security adviser, Stephen Rigby, will appear during the three-hour meeting as the committee attempts to flex its oversight muscle about Canada’s national security apparatus. “It is opportune that the heads of our national security institutions come before the … committee at this time of uncertainty,” Sen. Roméo Dallaire, the committee’s deputy chairman, said in a statement. “The increasing cyber threat and public safety debates require some oversight review and advice to government.”

Senators have been vocal about having better parliamentary oversight of national security issues, including calls to create a national security committee made up of MPs and senators who could receive classified briefings to ensure adherence to national and international laws. Such committees exist in the U.S. and U.K. The Harper government has so far rejected such an idea, saying the oversight system in place is working.

“Canadians want to know … if they walk into the airport, do they have to turn off their cellular phones and their laptops just in case they get spied on by the Canadian government?” NDP House leader Nathan Cullen told reporters in Ottawa. [Emphasis added]

MUST WATCH: Airport Wi-Fi used to track Canadians 4:16 Min. by CBC News, January 30, 2014

2014 01 30 SCEC oversighte retired judge minister defence PM Harper

Turns out the bigger secret was Canadians were the target. …

They’re not supposed to be tracking the activities of law-abiding citizens of Canada.

CSEC, under its legislation, cannot target Canadians anywhere in the world or anywhere in canada, including visitors to Canada.

….I can’t see any circumstance in which this would not be unlawful under Canadian law, under our Charter, under CSEC’s three mandates. …

No matter how CSEC characterizes its operation, the documents describe an elaborate cyber-tracking system.

Here we clearly have an agency of the state, collecting, in an indiscriminate and bulk fashion, all of Canadian communications. And the oversight mechanism is flimsy at best. That oversight is provided by a retired judge who reports to the Defence Minister and ultimately the Prime Minister, who appointed the watch dog in the first place. …

Just trust us
We’re doing the right thing
Don’t worry.

Yes! Worry! We have very good reason to worry. …

CSEC still denies it tracked Canadians.

CSEC’s airport Wi-Fi tracking (redacted PDF)

CSEC used airport Wi-Fi to track Canadian travelers: Edward Snowden documents, Electronic snooping was part of a trial run for U.S. NSA and other foreign services by Greg Weston, Glenn Greenwald, Ryan Gallagher, CBC News, January 30, 2014

Privacy and security experts on CSEC 2:32

Airport Wi-Fi used to track Canadians 4:16

A top secret document retrieved by U.S. whistleblower Edward Snowden and obtained by CBC News shows that Canada’s electronic spy agency used information from the free internet service at a major Canadian airport to track the wireless devices of thousands of ordinary airline passengers for days after they left the terminal. After reviewing the document, one of Canada’s foremost authorities on cyber-security says the clandestine operation by the Communications Security Establishment Canada (CSEC) was almost certainly illegal. Ronald Deibert told CBC News: “I can’t see any circumstance in which this would not be unlawful, under current Canadian law, under our Charter, under CSEC’s mandates.”

The spy agency is supposed to be collecting primarily foreign intelligence by intercepting overseas phone and internet traffic, and is prohibited by law from targeting Canadians or anyone in Canada without a judicial warrant.

As CSEC chief John Forster recently stated: “I can tell you that we do not target Canadians at home or abroad in our foreign intelligence activities, nor do we target anyone in Canada. In fact, it’s prohibited by law. Protecting the privacy of Canadians is our most important principle.”

But security experts who have been apprised of the document point out the airline passengers in a Canadian airport were clearly in Canada.

CSEC said in a written statement to CBC News that it is “mandated to collect foreign signals intelligence to protect Canada and Canadians. And in order to fulfill that key foreign intelligence role for the country, CSEC is legally authorized to collect and analyze metadata.” Metadata reveals a trove of information including, for example, the location and telephone numbers of all calls a person makes and receives — but not the content of the call, which would legally be considered a private communication and cannot be intercepted without a warrant.

“No Canadian communications were (or are) targeted, collected or used,” the agency says.

Deibert is author of the book Black Code: Inside the Battle for Cyberspace, which is about internet surveillance, and he heads the world-renowned Citizen Lab cyber research program at the University of Toronto’s Munk School of Global Affairs. He says that whatever CSEC calls it, the tracking of those passengers was nothing less than an “indiscriminate collection and analysis of Canadians’ communications data,” and he could not imagine any circumstances that would have convinced a judge to authorize it.

The latest Snowden document indicates the spy service was provided with information captured from unsuspecting travellers’ wireless devices by the airport’s free Wi-Fi system over a two-week period. Experts say that probably included many Canadians whose smartphone and laptop signals were intercepted without their knowledge as they passed through the terminal. The document shows the federal intelligence agency was then able to track the travellers for a week or more as they — and their wireless devices — showed up in other Wi-Fi “hot spots” in cities across Canada and even at U.S. airports. That included people visiting other airports, hotels, coffee shops and restaurants, libraries, ground transportation hubs, and any number of places among the literally thousands with public wireless internet access. The document shows CSEC had so much data it could even track the travellers back in time through the days leading up to their arrival at the airport, these experts say.

While the documents make no mention of specific individuals, Deibert and other cyber experts say it would be simple for the spy agency to have put names to all the Canadians swept up in the operation. All Canadians with a smartphone, tablet or laptop are “essentially carrying around digital dog tags as we go about our daily lives,” Deibert says. Anyone able to access the data that those devices leave behind on wireless hotspots, he says, can obtain “extraordinarily precise information about our movements and social relationships.”

Trial run for NSA
The document indicates the passenger tracking operation was a trial run of a powerful new software program CSEC was developing with help from its U.S. counterpart, the National Security Agency. In the document, CSEC called the new technologies “game-changing,” and said they could be used for tracking “any target that makes occasional forays into other cities/regions.” Sources tell CBC News the technologies tested on Canadians in 2012 have since become fully operational.

CSEC claims “no Canadian or foreign travellers’ movements were ‘tracked,'” although it does not explain why it put the word “tracked” in quotation marks. Deibert says metadata is “way more powerful than the content of communications. You can tell a lot more about people, their habits, their relationships, their friendships, even their political preferences, based on that type of metadata.”

The document does not say exactly how the Canadian spy service managed to get its hands on two weeks’ of travellers’ wireless data from the airport Wi-Fi system, although there are indications it was provided voluntarily by a “special source.” The country’s two largest airports — Toronto and Vancouver — both say they have never supplied CSEC or other Canadian intelligence agency with information on passengers’ Wi-Fi use. Alana Lawrence, a spokesperson for the Vancouver Airport Authority, says it operates the free Wi-Fi there, but does “not in any way store any personal data associated with it,” and has never received a request from any Canadian intelligence agency for it. A U.S.-based company, Boingo, is the largest independent supplier of Wi-Fi services at other Canadian airports, including Pearson International in Toronto. Spokesperson Katie O’Neill tells CBC News: “To the best of our knowledge, [Boingo] has not provided any information about any of our users to the Canadian government, law enforcement or intelligence agencies.”

It is also unclear from the document how CSEC managed to penetrate so many wireless systems to see who was using them — specifically, to know every time someone targeted at the airport showed up on one of those other Wi-Fi networks elsewhere. Deibert and other experts say the federal intelligence agency must have gained direct access to at least some of the country’s main telephone and internet pipelines, allowing the mass-surveillance of Canadian emails and phone calls.

Ontario’s privacy commissioner Ann Cavoukian says she is “blown away” by the revelations. “It is really unbelievable that CSEC would engage in that kind of surveillance of Canadians. Of us. I mean that could have been me at the airport walking around… This resembles the activities of a totalitarian state, not a free and open society.”

Experts say the document makes clear CSEC intended to share both the technologies and future information generated by it with Canada’s official spying partners — the U.S., Britain, New Zealand and Australia, the so-called Five Eyes intelligence network. Indeed, the spy agency boasts in its leaked document that, in an apparently separate pilot project, it obtained access to two communications systems with more than 300,000 users, and was then able to “sweep” an entire mid-sized Canadian city to pinpoint a specific imaginary target in a fictional kidnapping. The document dated May 2012 is a 27-page power-point presentation by CSEC describing its airport tracking operation. While the document was in the trove of secret NSA files retrieved by Snowden, it bears CSEC’s logo and clearly originated with the Canadian spy service.

Wesley Wark, a renowned authority on international security and intelligence, agrees with Deibert. “I cannot see any way in which it fits CSEC’s legal mandate.” Wark says the document suggests CSEC was “trying to push the technological boundaries” in part to impress its other international counterparts in the Five-Eyes intelligence network. “This document is kind of suffused with the language of technological gee-whiz.”

Wark says if CSEC’s use of “very powerful and intrusive technological tools” puts it outside its mandate and even the law, “then you are in a situation for democracy where you simply don’t want to be.”  

Like Wark and other experts interviewed for this story, Deibert says there’s no question Canada needs CSEC to be gathering foreign intelligence, “but they must do it within a framework of proper checks and balances so their formidable powers can never be abused. And that’s the missing ingredient right now in Canada.” The only official oversight of CSEC’s spying operations is a retired judge appointed by the prime minister, and reporting to the minister of defence who is also responsible for the intelligence agency.

“Here we clearly have an agency of the state collecting in an indiscriminate and bulk fashion all of Canadian communications and the oversight mechanism is flimsy at best,” Deibert says. “Those to me are circumstances ripe for potential abuse.”

CSEC spends over $400 million a year, and employs about 2,000 people, almost half of whom are involved in intercepting phone conversations, and hacking into computer systems supposedly in other countries.

It has long been Canada’s most secretive spy agency, responding to almost all questions about its operations with reassurances it is doing nothing wrong. [Emphasis added]

Spy agency reportedly kept tabs on passengers at a major Canadian airport by Charmaine Noronha, January 31, 2014, The Associated Press in Calgary Herald
A secret document leaked by U.S. whistleblower Edward Snowden shows Canada’s electronic spy agency used information gleaned from a free internet service at a Canadian airport to track the wireless devices of thousands of airline passengers. … The Canadian Broadcast Corporation obtained the document and posted it to its website Friday. The report, dated May 2012, is a 27-page PowerPoint presentation describing the spy agency’s airport tracking operation. According to the document, the agency tracked metadata including the location and telephone numbers of calls made and received but not the content.

The spy agency is supposed to collect primarily foreign intelligence by intercepting overseas phone and internet traffic. It is prohibited by law from targeting Canadians without a judicial warrant.

The agency’s spokeswoman Lauri Sullivan said no Canadian or foreign travellers were tracked or targeted and no information was collected or used. [Is SCEC trustworthy enough to believe what they say? How can they tell which units they targeted are foreign or Canadian?]

2014 01 31 CSEC spying at canadian airport title page

2014 01 31 CSEC spying at canadian airport

2014 01 31 CSEC spying at canadian airport pg 25

“The classified document in question is a technical presentation between specialists exploring mathematical models built on everyday scenarios to identify and locate foreign terrorist threats. The unauthorized disclosure of tradecraft puts our techniques at risk of being less effective when addressing threats to Canada and Canadians,” Sullivan said. The document indicates the passenger tracking operation was a trial run of a new software program the spy agency was developing with help from its U.S. counterpart, the National Security Agency. The spy agency called the new technologies “game-changing,” and said they could be used for tracking “any target that makes occasional forays into other cities/regions.”

Sullivan said that in 2011, the agency’s Commissioner completed a review specifically focused on its metadata activities, finding them to be lawful. The Commissioner is currently conducting another review of its metadata activities, she said. Ontario Privacy Commissioner Ann Cavoukian told the CBC that it’s “unbelievable” the Canadian spy agency would engage in that kind of surveillance of Canadians saying it “resembles the activities of a totalitarian state.” Cavoukian earlier this week commended the efforts of Snowden to preserve civil liberties and encouraged Canadians to follow suit by insisting upon greater transparency and accountability from the federal government and the Communications Security Establishment Canada. [Emphasis added]

Spy agency’s work with CSIS, RCMP fuels fears of privacy breaches by Colin Freeze, January 31, 2014, The Globe and Mail
Canada’s foreign-intelligence surveillance agency received nearly 300 requests for assistance from domestic security agencies over a four-year period – a degree of collaboration that is raising alarm bells for privacy advocates. A disclosure from Communications Security Establishment Canada, obtained by The Globe through an Access to Information request, shows the Canadian Security Intelligence Service sought help from CSEC 205 times between 2009 and 2012. The RCMP made 85 such requests during the same time span. These “support to lawful access” figures – which have never been released before – show that close collaboration with other federal agencies is routine for Canada’s electronic-eavesdropping agency.

Watchdogs and judges have recently raised concerns that ill-considered intelligence collaborations can lead to illegal wiretapping, wrongful arrests – or even violence against travelling Canadian suspects who are red-flagged to intelligence agencies operating overseas. On Tuesday, the Office of the Federal Privacy Commissioner called upon CSEC to “proactively disclose” just how much it is working with the other federal agencies. CBC reported that CSEC used information from free Internet service at a major Canadian airport to gather data about travellers.

One issue is whether the various federal agencies use compatible legal standards to collect information: The RCMP and CSIS rely on their officers getting judges to sign off on warrants that allow them to tap a suspect’s phone. Yet CSEC is an electronic eavesdropping agency that operates under unique laws, whose computer scientists warrantlessly spy on foreigners and collect communications in bulk, while being barred from targeting Canadians or people in Canada. Those capabilities make CSEC an attractive – and legally challenging – partner for the other agencies. “If this is an end run around the warrant process, it is not legal,” said Micheal Vonn, a lawyer for the B.C. Civil Liberties Association.

Yet, Canada’s laws explicitly allow CSEC to offer “technical and operational assistance” to the RCMP and CSIS. CSEC officials are on the record saying they can unencrypt materials seized by the domestic agencies. The records released to The Globe also suggest this assistance takes the form of CSEC lending out sophisticated bugging technology or sifting volumes of communications and records lawfully seized by the other agencies. The records also show that frequently CSEC is also asked to arrange a mysterious surveillance technique known as a “DIFT” – a “domestic interception of foreign telecommunications.” This technique has lately emerged as controversial. Last month, a Federal Court judge who had legally endorsed the DIFT power as a global extension of made-in-Canada warrants renounced parts of his landmark 2009 decision. Judge Richard Mosley wrote that he has since learned that CSEC and CSIS had machinated to keep his court “in the dark” about key facts, so that they could globally keep tabs on Canadian terrorism suspects.

CSEC takes pains to reassure Canadians it operates lawfully. The agency “follows all Canadian laws, including the Privacy Act, and has stringent policies and procedures in place,” wrote Lauri Sullivan, a spokeswoman for the agency, in an e-mailed response to Globe questions. Records show CSEC got 294 requests for help from all other federal agencies from 2009 to 2012. All came from the RCMP and CSIS save for three requests from Canada’s border guards and one request from the military. The total numbers stayed relatively constant at between 70 and 80 requests each year. No statistics were released speaking to how often CSEC rejects these requests. The surveillance agency had initially blocked The Globe and Mail’s Access to Information request on national security grounds, but the figures were released after an appeal to the federal information commissioner.

The records show the federal agencies most often – 77 times between 2009 and 2012 – came to CSEC seeking specialized “tools.” (Experts say this is likely a reference to sophisticated bugging devices, possibly similar to ones lately revealed to have been used by CSEC’s American counterpart.)

Another 45 requests were made for “processing” seized materials. On 51 other occasions, the agencies sought help in arranging DIFTs.

CSEC has never spoken to how it would, from Canada, capture the telecommunications trails of specific terrorism suspects travelling abroad. Yet several Federal Court rulings have highlighted that this capability exists. In a ruling released in December, Justice Mosley wrote that he regretted aspects of his 2009 decision to let CSEC and CSIS team up to keep tabs on terror suspects as they left Canada. He said he had since learned the two agencies failed to disclose to him their practice of outsourcing some of the surveillance work to American and British allies. Such practices unlawfully put Canadian suspects in jeopardy, Justice Mosley wrote, by exposing them to the risk they may be “detained or otherwise harmed“ by the intelligence agencies far more aggressive than Canada’s. “The conclusion … that the Court has the jurisdiction to issue a warrant … for the domestic interception of foreign telecommunications under certain defined conditions remains valid in my view,” the ruling reads. But this power “does not extend to the authority to empower the Service [CSIS] to request that foreign agencies intercept the communications of Canadian persons travelling abroad either directly or through the agency of CSEC.” [Emphasis added]

Spy agency reportedly kept tabs on passengers at a major Canadian airport: CBC by The Canadian Press, January 30, 2014, Lethbridge Herald
Canada’s electronic eavesdropping agency reportedly tracked the wireless devices of thousands of travellers by using information gleaned from free internet service at a major Canadian airport. The CBC is reporting the revelation is contained in a top secret document retrieved by U.S. whistleblower Edward Snowden. The network says the document indicates the Communications Security Establishment Canada was given information taken from wireless devices using the airport’s free Wi-Fi system over a two-week period. It’s not clear which airport was involved. The document shows the CSEC was then able to track travellers for a week or more as they showed up in other Wi-Fi locations in cities across Canada.

A CSEC statement given to the broadcaster would not confirm or deny the CBC report.

Ontario Privacy Commissioner Ann Cavoukian told the CBC it’s “unbelievable” CSEC would engage in that kind of surveillance of Canadians saying it “resembles the activities of a totalitarian state.”

Earlier this week, interim federal privacy commissioner Chantal Bernier said the CSEC should tell Canadians more about what it’s doing.

The document the CBC obtained said the Wi-Fi exercise was part of a pilot project done alongside CSEC’s American counterpart, the National Security Agency. According to the document, the agency tracked metadata including the location and telephone numbers of calls made and received but not the content. [Emphasis added]

Video: Defence Minister dismisses report of spying on wireless devices by Calgary Herald, January 31, 2014
The [Harper] government is dismissing a report that Canada’s electronic eavesdropping agency tracked the wireless devices of travellers at a major Canadian airport. Defence Minister Rob Nicholson says the report is false. [Saying doesn’t counter the evidence. Emphasis added]

Edward Snowden nominated for Nobel peace prize, Two Norwegian politicians say NSA whistleblower’s actions have led to a ‘more stable and peaceful world order’ by Associated Press, January 29, 2014, The Guardian
Edward Snowden will be one of scores of names being considered by the Nobel prize committee. Two Norwegian politicians say they have jointly nominated the former National Security Agency contractor Edward Snowden for the 2014 Nobel peace prize. The Socialist Left party politicians Baard Vegar Solhjell, a former environment minister, and Snorre Valen said the public debate and policy changes in the wake of Snowden’s whistleblowing had “contributed to a more stable and peaceful world order”. Being nominated means Snowden will be one of scores of names that the Nobel committee will consider for the prestigious award. [Emphasis added]

This entry was posted in Global Frac News, Other Legal. Bookmark the permalink.