CSIS suspends bulk data mining pending new guidelines

Share

Canada's domestic spy service has halted its "bulk collection" of data after criticisms were raised within government about the lawfulness of such techniques.

A watchdog agency's new report about the Canadian Security Intelligence Service speaks of little-known CSIS data-mining programs, and of how some have recently been suspended because of a lack of clear rules and guidelines surrounding them.

CSIS is said to have wanted to leverage big pools of data "to identify previously unknown individuals of interest by linking together types of information that have mirrored threat behaviour," according to the report. But after concerns raised in the report, "CSIS agreed to halt ingesting bulk data sets pending" new rules.

Related: Concerns over Bill C-51 prompt CSIS to brief other agencies on operations

Related: Liberals' delay in changing Bill C-51 raises suspicions

These findings are from the Security Intelligence Review Committee (SIRC), the watchdog agency that tabled its annual report in Parliament on Thursday.

The cryptic discussion of CSIS's "data management and exploitation activities" is intriguing on several levels. Talk of spies "ingesting" data in "bulk" has had connotations of intelligence officials indiscriminately amassing citizens' telecommunications records. Yet CSIS officers, who work to track terrorists within Canada, are generally understood to handle cases one wiretapping warrant at a time. This makes them more like conventional police detectives than the foreign-focused signals-intelligence – or "sigint" – spies who deal in volume.

On Thursday, a CSIS spokeswoman said the agency engages in a different kind of "bulk." "The collection referred to in the SIRC report is not the same collection that is sometimes done by sigint agencies," said Tahera Mufti.

She said what was at issue was CSIS collecting "data sets like maps, foreign telephone directories, and airport codes." She did not explain how such data pools would help CSIS track terrorists.

The fundamental critique of SIRC, which won't speak to what kind of data it is referring to, is that CSIS has been amassing records at rates that may push past the parameters of federal law. Under its 1984 act, the spy agency can only collect information that is "strictly necessary" to preserve national security.

SIRC says the spy agency it watches keeps two kinds of records. "Referential" data sets are less inherently sensitive, and acquired through publicly available means. This probably means CSIS is buying material from "Big Data" brokers who routinely sell similar material to corporations.

But CSIS also independently acquires "non-referential" data. SIRC regards such records as relatively intrusive "as they contain bulk information on a wide variety of individuals," the report says. "However, these can only be retained if they are assessed as being relevant to an ongoing, mandated investigation."

If CSIS wants to dredge up any data in bulk, SIRC says there needs to be compelling reasons. "If there is no reasonable alternative to bulk collection, CSIS needs to provide an objective assessment of how closely connected the bulk information is to intelligence of value," reads the report. This week, the federal Privacy Commissioner called for Parliament to pass new laws after finding Canada's other intelligence agency had been careless with records about the logged telecommunications of Canadians.

Communications Security Establishment (CSE), a foreign-focused "sigint" agency, says that whenever it collects Canadians' telecommunications trails, it does so only "incidentally." That's because it is pursuing foreign records in enormous volumes.

While CSIS and CSE have vastly different mandates, they also have adjacent headquarters. They can team up if a Federal Court judge endorses a joint operation.

In 2013, the former U.S. intelligence contractor Edward Snowden leaked documents to the media about the bulk collection of American citizens' telecommunications trails.

One revealing record showed CSE's and CSIS's U.S counterparts teamed up to acquire Americans' phone bills, thanks to sweeping warrants signed in secret courts. The United States "targets the communications of everyone. It ingests them by default," Mr. Snowden said.