Highly classified documents obtained by VICE News offer new insights into how Canada's two-headed spy apparatus works to blend its intelligence, skirt court oversight of its spying powers, and intercept communications inside the country's borders.
The documents are protected under Canada's highest intelligence classifications of "secret" and "top secret" and reveal that even the Canadian government was nervous over the agencies' effort to try and give themselves more latitude to operate free of political oversight.
The 87 pages, released under Canada's access to information laws, include three agreements between the country's domestic spy agency, the Canadian Security Intelligence Service (CSIS), and its foreign intelligence counterpart, the Communication Security Establishment (CSE), as well as meeting notes and memos. It, however, is carefully redacted to keep secret crucial details about their work.
Those who closely follow Canada's intelligence community, were not surprised to learn that the country's two main spy bodies worked so closely. For civilians, like independent member of parliament Brent Rathgeber, it's the limited oversight that gets their antennas up.
"We know that Canada's electronic spy agency works collaboratively with [CSIS]. It farms metadata and it sifts through millions of videos and documents downloaded online daily," said Rathgeber, who has introduced legislation to increase oversight of the two agencies.
"Engagement in wholesale mass surveillance is a dangerous proposition, especially with limited review and oversight."
A History of Cooperation
The agreements date back to 1990, more than a decade before the Canadian government even formally recognized CSE's existence.
Another agreement signed in 2007 spells out in more specific terms how the two agencies would cooperate and share information in a post-9/11 context.
Then, in early 2010, the two agencies decided to draw up a framework agreement, which would improve "intelligence collection, information sharing, and operational support." That document serves as a sort of constitution for how the agencies would handle their ongoing cooperation.
CSIS, referred to as "the Service" in the documents, is the human intelligence part of the equation. It focuses primarily on domestic investigations, everything from foiling anti-terror plots to spying on geology professors and infiltrating anti-capitalist groups. It has no formal law enforcement powers, in that it cannot arrest people, but new legislative changes will mean that it will gain the broad power to 'disrupt' threats. CSIS will also gain the ability to operate anywhere in the world, ignoring the laws of other countries in the process.
CSE, or "the Establishment," is the signals intelligence side of things. Often described as "Canada's NSA," it is the go-to body for data interceptions — whether that's snatching two-way communications like phone calls and emails, or whether it's collecting bulk data from certain websites. Documents released by Edward Snowden have shed light on CSE's previously little-understood powers, revealing that the Canadian spooks have become important players in the West's data collection operations.
Cooperation between the two has always been a bit of a gray zone. CSE's mandate forbids it from spying on Canadians anywhere in the world. Part C of its mandate, however, allows it to do data collection and analysis for other agencies, like CSIS, which focuses primarily on snooping Canadians' subversive or hostile activities.
"There are aspects of how information is acquired and shared by CSE now that are a mystery, and what little we do know already raises some disturbing questions," writes Ron Deibert, Director of the Citizen Lab at the University of Toronto's Munk School.
And perhaps that concern is well-placed. A former Commissioner for CSE — the only person providing independent oversight of the agency — warned in a 2008 report that its cooperation with CSIS was allowing the Establishment to spy on Canadians by collecting their metadata.
Christopher Parsons, postdoctoral fellow at the Munk School, says there is long-standing ambiguity over when CSE can and cannot spy on its own citizens. And it's worrying.
"Generally, we have questions about how meaningful, or not meaningful, Mandate C actually is," he told VICE News.
Craig Forcese, law professor at the University of Ottawa and one of Canada's foremost experts on security policy, says Mandate C is a tunnel through the barrier stopping CSE's from snooping on Canadians.
"If CSE is providing assistance to CSIS under Mandate C, then CSE is clothed with the same legal authority CSIS has," Forcese says. "So it can act as CSIS's technological appendix, including in conducting domestic surveillance."
University of Ottawa Professor Wesley Wark, a specialist in intelligence and national security, says there is need for a review body that can actually investigate how Mandate C is used, "in a way typically that the current CSE Commissioner has not, I don't think, very fully."
Deibert points to an example where CSIS and CSE were caught misleading a federal court about their surveillance activities.
The court reprimanded both agencies after it came to light that warrants intended to authorize CSE to intercept foreign communications from within Canada (known as Domestic Interception of Foreign Telecommunications and Search warrants, or, DIFTS) were actually being outsourced to foreign spy agencies, including the NSA. The Canadian agencies had failed to disclose that fact to the judiciary.
"A decision was made by CSIS officials, in consultation with their legal advisors, to strategically omit information in applications for [DIFT] warrants about their intention to seek the assistance of the foreign partners," Justice Richard Mosley ruled in 2013.
The documents obtained by VICE News illustrate the strategy that both agencies were employing to obtain those DIFTS warrants.
Minutes of an April, 2010 meeting between CSE and CSIS brass reads that the agencies were looking to adopt a "bridge" memorandum of understanding to set "terms and conditions" of when CSE would execute those warrants. Much of those meeting minutes are redacted, likely under solicitor-client privilege.
Lawyers for CSE and CSIS present at those meetings would later go to court to defend the legality of the warrants in court. Mosley's decision was upheld by a federal court of appeal and is now heading to the Supreme Court.
It's still not quite clear what those warrants were used for — though we know that they've been used dozens of times — but combining the expertise of CSIS, CSE and the NSA is something that has worried privacy advocates.
While Justice Mosley may have temporarily ended the participation of the NSA in those collection exercises in his 2013 decision, legislation passed this year giving CSIS power to operate abroad almost certainly re-authorizes that sort of data interception.
To that end, the governing Conservative Party has long been friendly to Canada's intelligence agencies, presiding over substantive budget increases and widening their legal authority. However, when the Service and the Establishment tried to give themselves the power to write their own legal agreements, the government balked.
"The generic arrangement with CSE will outline the general principles underlying all cooperation and will provide flexibility to the Service to review existing arrangements and to enter into future more specific arrangements with CSE as the need arises, without the necessity to seek your approval each time. You would continue to be briefed regularly as expected," writes then-CSIS director Richard Fadden to then-Public Safety Minister Vic Toews in the March, 2010 documents obtained by VICE News.
Toews was not pleased.
"The Ministry returned the letter requesting further details to address concerns raised by the Minister's Office in relation to CSIS authority to enter into subsequent arrangements without further approval from the Minister each time," reads a summary of changes requested to the documents.
It's unclear if the minister's change was actually made.
"If the minister put a stop to that, he should be congratulated," says Parsons. The simple fact that the agencies were trying to bestow themselves that power is "more than a little bit concerning," he says.
An unknown number of pages were withheld by the government. Records relating to the ad hoc agreements adopted by the two agencies appear to be missing. The documents that were provided, however, do shed a sliver of light onto the otherwise little-understood agencies, and how they cooperate.
For one, the agreements reveal that an actual organizational structure bridges the two bodies. They lay out which directors can authorize information sharing, and which are responsible for ensuring the rules are not broken. The MOUs also establish Joint Management Teams (JMTs) which "will meet on a regular basis to address issues of mutual interest and to modify or confirm priority activities for cooperation."
Forcese told VICE News he's not tremendously surprised by the documents. But he suspects they aren't the full story.
"The documents give the impression of being quite high level," Forcese says. "You look at them and you wonder: what does this actually mean in practice? I guess that's decided on the ground."
Bill Robinson, who has been blogging about CSE for a decade, raises two red flags about the documents — what's missing, and what the two agencies have never really spoken about.
He told VICE News that what interested him was the redactions inside the documents. The signed, April 2012, agreement reads that: "the Service currently has three specific Memoranda of Understanding with CSE which address ongoing cooperation in the performance of our duties and functions under sections 12, [REDACTED], 16 of the CSIS Act."
Section 12 allows CSIS to investigate domestic national security threats, and Section 16 allows them to investigate foreign entities. Section 15, which Robinson deduces is behind the redaction, empowers CSIS to conduct security assessments of individuals. If that's the case, that means that Canada's bulk data collection agency is in the game of collecting the personal information of anyone applying for security clearance — that could include bureaucrats, defense contractors, spies, and certain politicians.
The original 1990 MOU between the agencies reads that "all information which may be used in the investigation or prosecution of an alleged contravention of any law of Canada or a province shall be reported to the Service."
It continues that, before any intelligence obtained by CSE can be used in an application to a judge, "the Service undertakes to consult fully with the Establishment," and that it will alert the Justice Department.
It's long been speculated that signals intelligence has been the basis for many warrants and criminal charges, but that the fingerprints of CSE's involvement were scrubbed before the application to the court was made.
"There's a real question whether it's CSE or CSIS in the driver's seat," says Parsons.
Robinson says the 1990 agreement adds gasoline to the long-held fear that CSE is staged to become a sort of "Panopticon," reporting all criminal wrong-doing that comes across its path. He gives the example of Levitation, the program under which the Establishment monitored millions of downloads from file-sharing websites. If those downloads break copyright, can CSE refer them to the police? While CSE may not be engaging in those practices right now, it's those plausible hypothetical questions that have long troubled privacy experts.
CSIS maintains that it always operates within the law, including when it works with CSE.
"Both organizations operate to protect Canada and Canadian interests, and there are many ways to support one another while always respecting our distinct mandates," a spokesperson for CSIS wrote in response to a VICE News media request. They underlined that CSIS is subject to scrutiny by an independent review body.
The cooperation between the Service and the Establishment isn't just on paper. They live together.
CSE and CSIS share a campus in east-end Ottawa, surrounded by high fences, tight security, and signs informing passers-by not to photograph the compound. They moved in together in recent years.
Security on the campus is extremely tight.
That was abundantly clear on a recent visit, when VICE News was told to leave the property, as well as the street outside the headquarters, then was followed by a police cruiser. VICE's information was written down by private security as well as a CSIS agent.
CSIS says rules forbidding photography of theirs and CSE's employees is merely to protect them from the lingering threat of the Islamic State's commitment to attack law enforcement and military personnel.
While the Service is an independent investigative force, with its own governing legislation, the Establishment is a subset of the Canadian military and has obligations to aid Canada's foreign policy.
As the 2007 MOU notes, "the Establishment may acquire and use information from the global information infrastructure for the purpose of providing foreign intelligence relating to international affairs, defence or security, in accordance with Government of Canada intelligence priorities…detailed in the National SIGINT Priorities List (NSPL)."
The NSPL is a tightly-held document that, ostensibly, lays out which infrastructure, persons, groups, and nations that Canada is seeking to eavesdrop, spy on, or defend itself from. There is very little information available on exactly what it is.
There is little known at all about CSE's military application, and CSIS' role in it.
Though Wark notes some important symbolism at their adjacent headquarters.
They once even had plans for a bridge between the buildings, although those were ultimately scrapped.
Follow Justin Ling on Twitter: @justin_ling