Information & Ethics Committee on Dec. 6th, 2016

[Raj Saini, Liberal, Kitchener Centre, ON]

I ask because you mentioned earlier that whenever we do something, we have charter provisions, but that threshold is different in England because they have a higher threat matrix. In the United States you would have a higher threat matrix also. Maybe the information we sent met our threshold, but it might be a little bit looser or a little bit more exaggerated in other countries where the threat matrix is higher.

[Anil Kapoor]

Generally speaking, as I said, intelligence agencies tend to abide by this notion of an implicit caveat. There are also explicit caveats that are placed on intelligence that will say “Not to be used for...”, and you fill in the blanks. We rely upon our partners to follow those caveats, as they rely upon us to follow theirs. There is a mutuality to it.

I think that when you step out of the Five Eyes, European intelligence agencies will probably follow the caveats as well, for the most part. When you get further afield, it's much more difficult to ensure, but within the Five Eyes I think caveats are well respected, and everybody gets the protocol.

I want to add something very briefly. I'm going to part company with my colleague here on the question of retention, and I'm going to do it in this way.

To the extent that the service properly receives—and I underscore “properly”—information about national security threat information, I don't think it's wise for the service to destroy it. I don't think it's wise. Today it may not mean much, but 10 years from now or five years from now, when circumstances change and you're continually revising your analytics, you need to have a rich environment to be able to stay on top of the threat environment.

[Raj Saini, Liberal, Kitchener Centre, ON]

Do you think there should be no sunset provision to say that information should be held for a certain period of time? Otherwise—

[Anil Kapoor]

I think that with respect to information that's properly in the hands of the service—and I underscore “properly”—they should be able to maintain their files.

[Raj Saini, Liberal, Kitchener Centre, ON]

But didn't you mention earlier that it would not be a virtue to trust a...?

[Anil Kapoor]

Well, no. I do accept that, but I'll give an example.

Let's say that you destroy a piece of information, and three years later. something happens. Perhaps a bomb goes off somewhere.

Where was the information? Why did nobody know about it? Well, you've destroyed the information or you weren't able to stay on top of that particular threat circumstance.

I think it would require extraordinary circumstances to destroy information that the service properly has, because they have an ongoing national security mandate.

From my perspective, if the service takes action and they do something and pass it to the RCMP for an investigation, it's going to end up in a court process, but I think it would be wrong to put an arbitrary time frame on how long the service should maintain it.

[The Chair, Conservative, Blaine Calkins]

Thank you, Mr. Saini and Mr. Kapoor.

We'll now move back to Mr. Jeneroux, and now we're in the five-minute round.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

The tone of your voice, Mr. Chair, suggests you're surprised that I would ask a second round of questions.

[The Chair, Conservative, Blaine Calkins]

I'm shocked, actually.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

I'll try not to disappoint.

Thank you to both of you.

Section 4 of the Security of Canada Information Sharing Act sets out a number of principles for information sharing under the act, including the following:

(c) entry into information-sharing arrangements is appropriate when Government of Canada institutions share information regularly

I want to get to some of the basic elements that you believe should be part of SCISA. Could you help lay those out for us as we debate this further?

[Ziyaad Mia]

In terms of the principles in those arrangements, you've heard from others that reliability is a core principle. We've talked about relevancy versus necessity. I'd concur with my colleagues Roach, Forcese, and Anil about necessity being a threshold. I believe Professor Forcese talked about “materiality”. I think that gets us more reliable information, so changing that standard would help, as would ensuring in those arrangements that there is rigour in the sharing, that we're looking to those criteria, and that there is necessity as well.

We talked about the life cycle of data. I'd like to see something about that. I don't entirely disagree with Mr. Kapoor. Yes, relevant information needs to be maintained, but a lot of irrelevant information may be pulled in, especially in the case of SCISA. That is what I'm concerned about. Therefore, I think those arrangements should also have an eye to the life cycle. How is data shared? How is it used? What happens to it afterwards? Also, is there some tracking of where it has gone within government agencies?

I come back to my suggestion that there be some kind of stickhandler in government who is overseeing this and setting standards in creating these arrangements, maybe with a model agreement or an arrangement that comes from the centre and has gone out to agencies.

[Anil Kapoor]

On this issue about necessity and the nature of the information-sharing agreements, I don't necessarily agree that materiality is a workable test. I am saying that because I think necessity is much easier to manage.

Materiality brings into relief not only what you know at the transmitting agency but also what the recipient agency or the requesting agency knows, because under this legislation the service could request from any one of the other 17 agencies. It's unworkable to say that the transmitting agency should know the service file. We have one intelligence agency, CSIS, so if CSIS thinks.... Pick somebody else, such as the CRA or the Department of Health. Let's say that for some reason CSIS thinks the Department of Health has important information for their case. The people at the Department of Health aren't going to know the entire CSIS brief, nor is it practical for them to know it, but they would need to know that to execute on materiality.

Necessity, by contrast, I think is more modest. The service can warrant why it's important to them, and Health Canada can then do its own due diligence on its own side. Materiality is just a very broad concept that brings it into a whole mosaic that I think is just not practical for all the various agencies to transact in parallel.

[Matt Jeneroux, Conservative, Edmonton Riverbend, AB]

Okay.

I want to jump into one of the questions that has been prepared by the Library of Parliament. I'm curious, Mr. Kapoor, to have it answered here. It's about the concerns addressed by the commission of inquiry into the Air India flight and how CSIS failed to share information with the RCMP about facts related to the investigation. Does SCISA respond to the commission's related concerns on that?

[Anil Kapoor]

It certainly allows for sharing of information, but this problem that existed in terms of Air India was really the result of a very immature approach by the RCMP and CSIS to their respective mandates. Of course, keep in mind that CSIS was a baby at that time. It had just been created.

The infrastructure problems and the lack of coordination that we saw in Air India have to a large extent been ameliorated by changes in the way in which the RCMP and the service deal with each other on a regular basis. That problem is working itself out, and the agencies are much closer and have a much more mature relationship today than they did then. This statute doesn't really affect that. It's going to happen anyway; it happened before this statute. The statute doesn't really enable that. It's just kind of more stuff, more information, but the real rigour happens in the ways in which those two agencies have decided to change how they coordinate with each other.

[The Chair, Conservative, Blaine Calkins]

Thank you very much.

We will now move to Mr. Lightbound.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Thank you very much. This is very interesting testimony.

I only have five minutes, so I'll ask you to try to keep your answers as short as possible.

My first question is in regard to the institutions that can send or receive information. In terms of your interest in Bill C-51, in regard to having so many institutions that can send information—from the Yukon Surface Rights Board to the federal Consumer Agency of Canada, which I didn't even know existed—has the case ever been made that they actually have information that is somewhat relevant to national security? Has there ever been a case made for the 17 agencies that are listed in schedule 3 that they have anything to do with it?

For instance, we have the Department of Finance, which deals with national security. It's on the recipient end. Has there ever been a case made for them to be on the recipient end of SCISA?

[Ziyaad Mia]

I'll take a quick shot at it, and then I'll let Mr. Kapoor handle the rest.

On the all-of-government sharing, clearly some government agencies may have information that would be useful in national security investigations. In terms of casting the net that wide, I don't know if a case has been made that it's just every conceivable government agency. That would be the troubling thing—that it would be cast so wide—but I wouldn't say that no other agency, other than national security agencies, would have information. Clearly there may be information in other agencies that may be useful in a national security investigation.

[Anil Kapoor]

To answer the question, there's a bit of irrationality going on here. The primary actors for national security are the service, the RCMP, the CSE, and then National Defence and the CBSA. Let's call them the main actors.

When you drill away from that and look at the Department of Transport, they may have a national security remit, but it would be sort of a knock-on remit, if I can put it that way. Let's say CSIS has intelligence about some weakness to some rail system somewhere, or somebody's going to blow up something at a rail system. They would then want to activate the Department of Transport for assistance, and our provincial partners as well.

It seems to me that it should be about information getting to the main actors in national security, because that's what this is about. It's not just simply the service giving information to the CRA to help them collect your taxes.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Would it be worth our while examining schedule 3 to perhaps make it narrow, which I don't think was done previously?

Mr. Mia, you mentioned section 9 and immunity. When Ann Sheppard, the senior legal counsel at the Department of Justice, testified here, I asked her what that provision actually meant. She said it was designed to encourage “responsible disclosure” and “charter-compliant disclosure”. I fail to see how granting immunity achieves that. She also mentioned that this position was meant to shield public servants and was never intended to shield the crown from prosecution.

I just want to know if you agree with that interpretation of section 9.

[Ziyaad Mia]

I don't agree with that. The section says “any person”. My concern with this....

I would agree with the first statement, that this act purportedly encourages information sharing. You don't need section 9 to do that.

I didn't have a chance to read her testimony, but the other piece is good faith. They may hang their hat on that, saying that these aren't malicious shares, but you can be negligent and act in good faith as well, in my view.

I think it includes the crown. I think it's pretty broadly worded. I think it's disingenuous to suggest that this facilitates sharing or—

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Encourages responsible disclosure.

[Ziyaad Mia]

—encourages that. I think civil servants should be acting in good faith all the time, and I think they should act within the law. When they step outside those bounds, the government should be held accountable. That would be my position.

[Anil Kapoor]

Really, this is just an indemnification issue. The government has to be responsible for mistakes. Individual persons are on this team and are transmitting information. Just by indemnification, the government can solve this problem so that they're not hung out to dry. From my perspective, we can get rid of this provision and have proper indemnification agreements.

[Joël Lightbound, Liberal, Louis-Hébert, QC]

Okay.

I have a last question for you, Mr. Mia. I think you talked about having a national security agency review. As it pertains to our study of SCISA, if we were to recommend having an agency or perhaps the Privacy Commissioner look at the information sharing that goes on pursuant to SCISA, how would you envision that this could be set up? Do you have any ideas in mind for us as we deliberate on what we want to recommend?

[Ziyaad Mia]

The Privacy Commissioner plays an important role because of the privacy protections, but the Privacy Commissioner is not a national security expert. That department does not have that expertise. That would be one of the issues. Would they have the clearances to get at everything and look at everything? That would be a concern, although certainly the expertise of the Privacy Commissioner is welcome.

The recommendation I've also made is that other than the committee of parliamentarians, we need to have one unified, arm's-length, well-resourced review agency—some call it super-SIRC, but I like it call it the Canada national security review agency—to oversee all of national security. That organization could play a role in reviewing information sharing as well. The other piece, which I don't think would be touching as much on information sharing as on the law policy side, is the independent reviewer of national security law and policy.

The last piece I've suggested is that within government itself, probably within Public Safety and reporting to the minister, there should be some sort of information-sharing czar to oversee all of it. When you have all these pieces moving, we could actually have a national security disaster if something weren't caught or we could have a disaster when mistakes were made. Someone in government who's actually a bureaucrat could be overseeing all of this and reporting to the minister.

Those would be all the pieces, I think. There would be one from the public watchdog side but also one in government to make sure all the parts are moving well.