OTTAWA—A culture within Canada’s cyberspy service of “resisting and impeding” independent review has frustrated efforts to ensure it is obeying the law, say newly released documents from the federal intelligence watchdog.
The unusually candid National Security and Intelligence Review Agency records from 2021 are the latest evidence of the watchdog’s irritation at trying to scrutinize the operations of the Communications Security Establishment.
The CSE and the spy watchdog say strides toward smoother relations have been made in recent months.
The Ottawa−based CSE monitors foreign communications — from email and phone calls to text messages and satellite transmissions — for intelligence of interest to Canada. It also safeguards Canadian computer systems and engages in cyberoperations to counter threats from abroad.
The agency is a key element of the intelligence−sharing network known as the Five Eyes: Canada, the United States, Britain, Australia and New Zealand.
The review agency, known as NSIRA, was created in 2019 and assumed responsibility from another body for examining the cyberspy agency to ensure respect for the privacy of Canadians and overall compliance with the law.
The records say “long−standing and systemic difficulties have marred NSIRA’s ability to properly and adequately review national security activities at CSE,” adding the problems were due in part to “a larger culture of resisting and impeding the efficient progress of review activities.”
The review agency released the internal documents late last month under the Access to Information Act to Bill Robinson, a senior fellow at the University of Toronto’s Citizen Lab who has long studied the CSE.
In December 2021, Robinson asked the review agency for various records including correspondence detailing CSE co−operation with the watchdog’s requests for information related to its activities.
The documents show that in January 2021 a review agency member expressed concern to then−defence minister Harjit Sajjan that the relationship with CSE was not meeting expectations.
A review agency account of the conversation said, “There was an emphasis on the lack of access to CSE information and the delayed response times to NSIRA requests for information.”
The agency was seeking direct access to certain CSE databanks so it could independently verify information received from the spy service, carrying out its own queries in a timely way.
Delays in receiving information were adding about three months to the typical time frame for completing a review of a CSE program or activity, the watchdog said.
“Put succinctly, the approach taken at CSE towards Review requires a cultural change, one that displaces resistance, obfuscation and defensiveness, and instead emphasizes co−operation, transparency, and positive engagement,” says a late 2021 briefing note.
“Somewhat frustratingly, it has become apparent that our two organizations have different views on how to achieve the goal of ensuring the reliable and verifiable provision of timely and accurate information.”
Given the challenges experienced to date, the review agency note adds, “the relationship at present is poor.”
Overall, the difficulty “negatively affects our ability to fulfil our mandate and assure Canadians of the transparency and accountability of CSE’s activities.”
Robinson said in an interview the watchdog’s frustrations are concerning, given that co−operating with reviewers is an element of the spy service’s job. “Review is a vital part of the way we keep ensuring these agencies run well and that they protect the rights of Canadians.”
Asked about the concerns, the CSE said over the last year it had worked with the review agency to make two notable changes.
First, the CSE restructured its review co−ordination to better support NSIRA’s work and, second, the parties have agreed to a pilot project that gives the review agency independent access to CSE files related to reviews. This program began in March 2023.
The CSE insists that even before these changes it complied with all of NSIRA’s requests for information.
In 2022−23, the CSE supported 17 independent reviews by the review agency and held dozens of meetings and briefings with review staff, the cyberspy agency added.
In an interview, Nabih Eldebs, a CSE deputy chief for compliance and transparency, said he would chalk the differences up to “growing pains” of the two organizations as they came to better understand each other.
He added there is “clearly an intent within CSE” to make the relationship succeed “and we’ve worked hard to do that.”
In a statement, the review agency said in the last few months the CSE “has improved its efforts to facilitate NSIRA’s access to information.”
“While challenges remain, we continue to work with CSE and are hopeful remaining issues can be overcome.”
Daniel Minden, a spokesman for Defence Minister Anita Anand, the cabinet member responsible for the CSE, said the minister “takes NSIRA’s reviews extremely seriously, and is committed to ensuring that NSIRA receives the access that it needs to fulfil its mandate.”
“Minister Anand will continue to support NSIRA’s mandate to conduct expert, independent review of security and intelligence activities — and has met with NSIRA leadership regarding this mission.”
