CBC certainly broke an interesting story this morning with the release of documentation from Edward Snowden’s collection. The story “CSEC used airport Wi-Fi to track Canadian travellers: Edward Snowden documents” indicates ‘Canada’s electronic spy agency used information from the free internet service at a major Canadian airport to track the wireless devices of thousands of ordinary airline passengers for days after they left the terminal.’
Understandably this is causing a bit of a kerfuffle. CSEC has issued a statement that states that in order to fulfil CSEC’s foreign intelligence role ‘CSE is legally authorized to collect and analyze metadata. In simple terms, metadata is technical information used to route communications, and not the contents of a communication.’
While more is sure to break on this in the coming days I’ll stick my neck out here and suggest this may not have been against the law. If this was an exercise or trial or field test of a capability still in development then it wasn’t an intelligence gathering operation and, as such, might be considered permissible.
It’s a guess, and I stress might be considered permissible. And, since I am no lawyer I stand to be corrected and will be happy to admit my guess or interpretation is incorrect in due course if lawyers and other experts whose opinions and views I pay attention to come to a different conclusion.
CBC used two experts I do pay attention to, Ron Diebert and Wesley Wark, as commentators on this story and both are quoted. ‘Ronald Deibert told CBC News: “I can’t see any circumstance in which this would not be unlawful, under current Canadian law, under our Charter, under CSEC’s mandates.” Wesley Wark is quoted, inter alia, “I cannot see any way in which it fits CSEC’s legal mandate.” Ann Cavoukian, Ontario’s privacy commissioner, is also quoted, noting ‘she is “blown away” by the revelations. “It is really unbelievable that CSEC would engage in that kind of surveillance of Canadians. Of us. … This resembles the activities of a totalitarian state, not a free and open society.”’
“Resembles the activities of a totalitarian state” is going too far for me, but so far it is not looking good for CSEC: my first reaction is in line with Diebert and Wark because it is hard to see how this is lawful given CSEC is prohibited from targeting Canadians. Indeed, the CBC story also quotes a recent statement from CSEC’s Chief: “I can tell you that we do not target Canadians at home or abroad in our foreign intelligence activities, nor do we target anyone in Canada. “In fact, it’s prohibited by law. Protecting the privacy of Canadians is our most important principle.”
I read the story again, looked at the document CBC posted – and well done to CBC for providing the source material on which the story is based even though CSEC and others are likely to be very unhappy about that and objectively I would conclude that this is getting into revealing the methods of intelligence collection and thus potentially detrimental to national security – and went back to CSEC’s statement. I also went back to the mandate of CSEC and the recent posting by the CSEC Commissioner.
After all that, my question: was this a foreign intelligence operation or support to another intelligence or law enforcement agency, i.e. CSIS or the RCMP? It seems not. Support provided by CSEC to CSIS and RCMP is subject to authorizations and approval has to have a target and this appears not to have a target. Second, as the CBC story notes, ‘the passenger tracking operation was a trial run of a powerful new software program CSEC was developing with help from its U.S. counterpart, the National Security Agency’ and CSEC’s own statement notes that ‘[t]he classified document in question is a technical presentation between specialists exploring mathematical models built on everyday scenarios to identify and locate foreign terrorist threats. … It is important to note that no Canadian or foreign travellers were tracked. No Canadian communications were, or are, targeted, collected or used. And all CSE activities include measures to protect the privacy of Canadians.’
This is beginning to look like an exercise or a field trial and not an intelligence operation. Does that make a difference?
To be honest I do not know since I’m no lawyer and one document fails to provide the context around this technique and method. But, I’m inclined to given CSEC the benefit of the doubt here and have a guess – and it is a guess – that since this appears to have been some kind of trial or exercise and CSEC’s own statement notes no Canadian or foreign travelers were tracked, that this was not an intelligence operation. As an exercise, or trial, or whatever else it might be called it might be permissible under Canadian law. However, I’m also inclined to agree with Ron Diebert’s observation in the CBC story: ’whatever CSEC calls it, the tracking of those passengers was nothing less than an “indiscriminate collection and analysis of Canadians’ communications data,” and he could not imagine any circumstances that would have convinced a judge to authorize it.’ Buried in the story is another issue of concern: ‘Deibert and other experts say the federal intelligence agency must have gained direct access to at least some of the country’s main telephone and internet pipelines, allowing the mass-surveillance of Canadian emails and phone calls.’
So what’s my point? Basically, is an exercise, or a field trial, or the testing of a capability an intelligence operation? Probably not, and potentially subject to a different interpretation of the law.
Thus, while at face value this looks like revelations with partial documentary evidence that CSEC has been using its capabilities in Canada, and that would be against the law according to most people’s understanding of the law (including my own), I am guessing that somewhere there is a piece of paper that provides a legal interpretation that exercises, trials, or tests of capabilities are permissible. It is a guess, but I think there is more to this story and the rationale behind the revealed activities than we currently know according to what is in the public domain.
Finally, while I am inclined to give CSEC the benefit of the doubt, the concerns expressed by CBC and others are legitimate and I happen to share many of them. An explanation is required and far more transparency is going to be necessary by CSEC and the Government.
By Jez Littlewood