Information & Ethics Committee on Dec. 8th, 2016

[The Chair, Conservative, Blaine Calkins]

I call the meeting to order.

Good morning, colleagues.

We are at our 40th meeting of the Standing Committee on Access to Information, Privacy and Ethics. We are resuming our study of the Security of Canada Information Sharing Act, otherwise known as SCISA.

We are delighted to have witnesses with us today, from the Office of the Communications Security Establishment Commissioner, Mr. Jean-Pierre Plouffe, who is commissioner. With him is Mr. J. William Galbraith, the executive director. From the Security Intelligence Review Committee, we have Pierre Blais, who is the chair, and Ms. Chantelle Bowers, who is the deputy executive director. From the Civilian Review and Complaints Commission for the Royal Canadian Mounted Police, we have Mr. Richard Evans, who is the senior director of operations, and Ms. Joanne Gibb, acting director, research, policy and strategic investigations unit.

Welcome, all, and thank you very much for being here today.

I'm sure none of you are rookies at appearing before a committee, so you know exactly what's going to happen. The translation devices are there. The committee's routine proceedings and standing orders allow for 10-minute presentations from each group. How you want to use that time is up to you. If only one person wants to do all of the talking, that's fine. Then we'll proceed to several rounds of questions and answers. We'll encourage you to be as insightful as possible, but as succinct as possible at the same time. I appreciate you all being here this morning.

We will start with the Office of the Communications Security Establishment Commissioner.

The floor is yours, Mr. Plouffe.

[Jean-Pierre Plouffe, Commissioner, Office of the Communications Security Establishment Commissioner]

Thank you, Mr. Chair and honourable members.

I am pleased to appear before this committee on the subject of the Security of Canada Information Sharing Act. As the chair has mentioned, I am accompanied by Mr. Bill Galbraith, the executive director of my office.

Before I make a few remarks about activities under this act, and since this is my first appearance before this committee, I will very briefly describe my mandate and the role of my office.

You have my biographical note, so I won't go over that, but I would like to say that I have found that my decades-long experience as a judge has stood me in very good stead in my three years as CSE Commissioner.

Being a retired or supernumerary judge of a superior court is a requirement set out in the National Defence Act, the legislation that mandates both my office and the Communications Security Establishment.

The CSE Commissioner is independent and arm's length from government. My office has its own budget granted by Parliament. I have all the powers under Part II of the Inquiries Act, which gives me full access to all CSE facilities, files, systems and personnel, including the power of subpoena, should that be necessary.

My mandate is threefold. First, I review the activities of CSE to determine whether they are in compliance with the law, including protecting the privacy of Canadian citizens. This is the major portion of my work. Second, I may receive and investigate any complaints I consider necessary. Complaints are rare, reflecting the foreign focus of CSE activities. Third, I have a duty to inform the Minister of National Defence and the Attorney General of Canada of any activity of CSE that I believe may not be in compliance with the law.

The commissioner’s external, independent role, focused on CSE, assists the minister responsible for CSE—that is, the Minister of National Defence—in his accountability to Parliament, and subsequently to Canadian citizens, for that agency. My annual report tabled in Parliament describes the results of my reviews.

Let me turn now to the Security of Canada Information Sharing Act, or SCISA. What I have to say will be relatively brief. I will describe to you the experience of my office with respect to SCISA and then make a number of brief points regarding the act.

First, my office, as a government institution, has not shared information under SCISA, and in all probability is unlikely ever to do so. During the first year that SCISA was in effect, the agency I that review—namely, the Communications Security Establishment, or CSE—has neither received nor shared information under that law.

My reviews of CSE include CSE information sharing with domestic and international partners. I review CSE activities to ensure that the information it collects and discloses complies with the law, ministerial direction, and internal CSE policies. This includes ensuring that satisfactory measures are in place to protect privacy and that these measures are effectively applied. I will continue to monitor whether CSE receives or shares any information pursuant to SCISA.

That CSE has neither received nor shared information under SCISA demonstrates that currently existing authorities are sufficient for it to share or disclose information with other government institutions.

The point was made more broadly in the annual report of the Privacy Commissioner, Mr. Therrien, noting from a survey of government institutions his office conducted of the first six months SCISA was in effect, that only five institutions either received or shared information pursuant to the act. Most institutions, a little like CSE, have been using pre-existing authorities.

I cannot answer if in the future CSE would receive or share information under SCISA, but the track record to date suggests little, if any. As I said, I will monitor this.

As to the act itself, there are three points I would comment on. These points were also raised by the Privacy Commissioner in his testimony before this committee, and I must say that I am in general agreement.

First is the question of threshold in order for information to be shared. In SCISA the threshold is relevance, and I quote from subsection 5(1) of the act:

if the information is relevant to the recipient institution’s jurisdiction or responsibilities

Where personal information is concerned, in my view the threshold should be higher. The Privacy Commissioner suggests necessity as a threshold. He states that this an international privacy standard, noting that the CSIS Act uses the threshold “strictly necessary” for CSIS to collect, analyze, and retain information.

Another example can be taken from the National Defence Act, where the established threshold is essentiality. In essence, in order for CSE to use and retain a private communication—where one end is in Canada—collected under ministerial authorization, CSE must determine whether the private communication is “essential”. I review these communications to ensure that is the case, and that information that is not “essential” has been destroyed.

The next point with regard to SCISA relates to safeguards to protect privacy. Given that CSE has not received or shared information under SCISA, I have no direct experience with this act in this regard. However, I can comment that the legislation mandating CSE has built-in privacy safeguards. These safeguards require CSE to have satisfactory measures in place to protect any information with a privacy interest that it can legally collect, retain, and use. I would agree with the Privacy Commissioner that there should be safeguards in SCISA to ensure protection of personal information.

A third point relates to the government institutions listed in Schedule 3 of SCISA. Only three of the 17 institutions listed in Schedule 3 are subject to expert review: CSE, which I review; CSIS, which is reviewed by my colleagues from SIRC; and the RCMP, reviewed by my colleagues from the Civilian Review and Complaints Commission, where Mr. Evans works.

The Privacy Commissioner has a mandate to review personal information policies and practices of all federal government institutions. In this context, Mr. Therrien is examining the schedule 3 institutions' use of SCISA and privacy protections. However, this is not enough. I suggest that there is a need for expert review for the 14 institutions not currently subject to review. This could be done either by a new review body, or bodies, or divided among the existing expert review bodies, much as recommended by Justice O'Connor in his commission of inquiry report 10 years ago in the Arar affair.

Perhaps there is a role here for the national security and intelligence committee of parliamentarians. The committee will have to establish its priorities, and this may be one area to examine. I look forward to working closely with the committee of parliamentarians and its secretariat.

Thank you for this opportunity to appear before you today. My executive director and I would be pleased to answer your questions.

We will be pleased to answer your questions to the best of our knowledge.

Thank you.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Plouffe.

We now move to Mr. Blais, for up to 10 minutes.

[Pierre Blais, Chair, Security Intelligence Review Committee]

Good morning, Mr. Chair and members.

Thank you for providing this opportunity to appear before you today in the context of your study of SCISA—I will not repeat the long name, either in French or in English—and specifically its impact on privacy and any desired changes in light of the national security consultation and review process that is currently under way.

Today, I hope to enrich your study by focusing on three key points.

First, I will briefly outline SIRC's work in reviewing CSIS's information sharing practices with domestic partners. Second, I will provide insight into SIRC's current review examining the impact of the Security of Canada Information Sharing Act, or SCISA, on CSIS's information sharing with domestic partners.

Third, I will explain SIRC's limitations when examining these exchanges, including those made under SCISA.

I will not take much time now to describe SIRC's mandate and responsibilities. I will be pleased to answer any questions about our work following my remarks.

I will simply state that SIRC is an independent external review body that reports directly to Parliament, as you know, on CSIS activities through an annual report. SIRC has three core responsibilities: to certify the CSIS director's annual report to the Minister of Public Safety, to conduct investigations into complaints from the public that happen from time to time, and to carry out in-depth reviews of CSIS activities. Simply put, SIRC is key in providing accountability to CSIS.

The issue of information sharing was thrust in the spotlight post 9/11 as greater integration became the new modus operandi of intelligence work. As such, information sharing has been, and remains, at the forefront of SIRC's review work. In fact, I would say this issue is an integral component of almost every review we undertake: whether through the lens of a review of a particular CSIS investigation, activity or program, in Canada or abroad, SIRC must invariably examine exchanges of information with domestic or foreign partners.

SIRC assesses these exchanges against a number of criteria. We ask ourselves the following questions.

First, did CSIS act in a manner that complies with Canada's laws and legal obligations? Second, did this exchange fall within the scope of the established framework for co-operation, such as a memorandum of understanding or a foreign arrangement? Third, was the information shared factually correct and did it accurately reflect the nature and extent of the threat? Fourth, what were the disclosure risks of sharing this information, and did CSIS take appropriate action to mitigate these risks? For example, did CSIS take into consideration the human rights records of the foreign agency? Finally, did CSIS collect and retain information only to the extent that was “strictly necessary”? My colleague spoke about this idea of “strictly necessary” earlier.

As a result of this work, SIRC has put forward a number of recommendations in recent years aimed at enhancing CSIS's information sharing practices. To give you an idea, with respect specifically to domestic partners, SIRC recommended that CSIS develop clearer and more robust overarching principles of co-operation with CSEC, that CSIS finalize the completion of sections of a memorandum of understanding with CBSA, and that it develop deconfliction guidelines and renegotiate a protocol with Global Affairs Canada, which is the new Department of Foreign Affairs.

Let me move to my second point. Consistent with our ongoing scrutiny of CSIS's information-sharing practices, this year SIRC committed to a review of SCISA to gain an understanding of SCISA's impact on CSIS's information sharing with domestic partners.

As part of this work, SIRC will review all exchanges of information involving CSIS that have taken place under the authority of SCISA. This will give us an appreciation of the nature and scope of these exchanges. More broadly, SIRC will seek to assess whether existing practices were altered by the new legislation and, if so, the direction of these changes.

SIRC also intends to examine CSIS's engagements with federal partners as they move forward with the implementation of SCISA. In this context, I will echo the views of others in underscoring the importance of putting in place a supporting framework, such as specific formalized agreements between and among the various government partners involved in exchange of information under SCISA.

You have heard from witnesses who have commented on the broad nature of the threshold for sharing contained in SCISA. On this point, SIRC is of the opinion that formalized agreements to address the finer points of what information will be shared, how it will be shared, and what safeguards are attached to the information once it is shared are especially important. For this reason, in our review we will be attentive to these formalized agreements, where much of the work of determining the precise balance of security and privacy concerns will inevitably take place.

Indeed, insofar as there is always a level of interpretation, an important emphasis must be on review as a safeguard against unreasonable exchanges. For that reason, the role of review bodies such as SIRC is essential in ensuring that the proper balance is maintained.

I should end by noting that our broad access to CSIS information is key to allowing us to review CSIS's exchanges of information with partners. As you may know, SIRC—and it's important to remember this—has the absolute authority to examine all information under CSIS's control, no matter how classified or sensitive, with the only exception of cabinet confidences. Therefore, SIRC can examine all information that is shared with CSIS and, equally, all information that is shared by CSIS to its partners.

There remain blind spots, however, and this brings me to my last point. Although SIRC has great powers to review CSIS, this ability does not extend beyond CSIS. This means that SIRC cannot assess the source, validity or reliability of the information provided to CSIS by its domestic partners, nor how CSIS information or advice is used by these partners. In short, SIRC cannot follow the thread of information to allow for a more comprehensive review of CSIS's interactions and exchanges with domestic partners. We have already outlined this in previous reports.

This limitation is compounded by two other interrelated issues, which we discussed in the context of debate surrounding the Anti-terrorism Act, 2015, and SCISA. Seventeen departments with a national security nexus, including CSIS, are listed in the legislation as the recipients of information sharing in respect “of activities that undermine the security of Canada”.

The first issue is that of those 17 departments, only three—CSIS, CSE and the RCMP—are subject to a dedicated review body. There is no review mechanism to scrutinize the exchanges of information of the other 14 departments.

The second issue is that the three review bodies in question, namely, SIRC, the Office of the Communications Security Establishment Commissioner—my colleague's organization—and the Civilian Review and Complaints Commission for the RCMP, cannot carry out joint work as their legislation extends only to the respective organizations they review.

In fact, we can share some information on our results generally and on operating practices, but we cannot share information, even if our relationship is very close.

In the absence of a body with jurisdiction over the broader national security community, or to a lesser extent an ability for review bodies to work together, there will be clear accountability gaps regarding domestic information sharing.

As many have commented on, considerations of SCISA cannot be separated from an assessment of the strength of the safeguards in place to monitor the exchanges that take place under its authority.

Let me conclude by thanking you for your work on this matter. Bringing this forward in this place is important for everybody, I would say.

The government has made a firm commitment to enhancing accountability. There is no doubt, in my view, that information sharing within Canada’s national security community should be subject to appropriate scrutiny. SIRC’s work no doubt helps to further this goal.

With respect to SCISA, SIRC looks forward to communicating the results of its SCISA review when they are finalized. As I mentioned, we are in the process of doing that right now. At the same time, I will take the opportunity to affirm to the committee that information sharing has always been a priority for SIRC and that we will continue to be alive to issues of information sharing.

With my colleague, I will be happy to answer any questions you have.

Thank you, Mr. Chairman.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Blais.

We now go to our last presentation and the Civilian Review and Complaints Commission for the RCMP.

Mr. Evans, would that be you?

[Richard Evans, Senior Director, Operations, Civilian Review and Complaints Commission for the Royal Canadian Mounted Police]

Thank you, Mr. Chair and members of the committee, for inviting us here today to discuss the Security of Canada Information Sharing Act and its implications for the RCMP and our commission.

In 2014, amendments to the RCMP Act resulted in the creation of the Civilian Review and Complaints Commission. While the previous RCMP Public Complaints Commission was largely reactive and driven by public complaints, the new commission has been given a broad mandate to oversee RCMP activities. The change most relevant to the question before this committee today is that the commission now has the ability to conduct systemic reviews of any RCMP activity to ensure it is being carried out in accordance with legislation, regulations, ministerial direction, or any policy, procedure, or guideline, without having a complaint from the public or linking it to member conduct.

With this new authority we are currently undertaking two such systemic reviews. The first, into workplace harassment within the RCMP, was initiated last year at the request of the Minister of Public Safety. The second, initiated by the commission chairperson, is into the RCMP's implementation of the relevant recommendations contained in the Report of the Commission of Inquiry into the Actions of Canadian Officials in Relation to Maher Arar. The commission's review on the latter is examining the RCMP's national security framework, including policies, training, and operational files, to determine whether they are consistent with Justice O'Connor's recommendations.

Specifically, the commission’s review is examining six key areas: one, the centralization and coordination of RCMP national security activities; two, the RCMP’s use of border lookouts; three, the role of the RCMP when Canadians are detained abroad; four, training of RCMP members in national security operations; five, RCMP information sharing with foreign entities; and six, RCMP domestic information-sharing practices.

Regarding the domestic information sharing, the commission is currently examining the adequacy, appropriateness, sufficiency, and clarity of RCMP policies, procedures, and guidelines as they pertain to domestic co-operation with federal agencies and departments involved in national security investigations. The goal is to measure their consistency with Justice O’Connor’s recommendations, including screening information for relevance, reliability, accuracy, and privacy; the use of caveats; and that the RCMP is continuing to refine its policy of co-operating with other federal agencies or departments involved in national security investigations.

With regard to the Security of Canada Information Sharing Act, the commission is examining, as part of this ongoing review, what the RCMP has put in place to address its new information-sharing powers, such as record-keeping of disclosures under the act, and how that relates to Justice O’Connor’s recommendations. For example, Justice O’Connor’s report stressed that information-sharing agreements or arrangements pertaining to integrated national security operations should be reduced to writing. This is important, and the commission will be examining whether the RCMP adheres to this recommendation with respect to information sharing relating to the Security of Canada Information Sharing Act.

With that, we'd be happy to answer any questions.

Thank you.

[The Chair, Conservative, Blaine Calkins]

That's very good, very brief.

I need a speaking list.

I have Mr. Erskine-Smith for the first seven minutes.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks very much.

I first want to make sure I understand the current state of affairs.

The Privacy Commissioner has done a bit of a survey with respect to information sharing or SCISA. He has a report before Parliament. Five institutions have either collected or disclosed information, four institutions have received information on 52 occasions, and three institutions have disclosed information on 58 occasions. CSIS is one of the four bodies that has received information; I don't know how many times. To date that information sharing has not been reviewed, but SIRC plans to review it.

Is that correct?

[Pierre Blais]

We are in the process.

As you know, we plan every year. Right now we have over 12 in our research plan, but we have other specific requests by the minister. One of them is on SCISA. We hope it will be completed by the spring. It will be in our report because, as you know, we're reviewing, we're not—

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

That's understood.

It might make sense, though, given the relatively modest number of times this has been used.... CSIS would never come to you and say, “Here is the information we received. Can you review it in a more timely manner to give Canadians assurance that the information is being shared properly and in accordance with the law?” That does not happen.

[Pierre Blais]

It's not necessarily the way it is.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Fair enough.

[Pierre Blais]

We conduct our operation of the committee. We review the activities of CSIS. You don't necessarily come to us asking, “Well, could you look at this and that?” We do that on our own. We prefer to be on our own to decide what we look at.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Fair enough. So too with the RCMP. You plan to review, but there has been no review at this time of the information that's been received by the RCMP under SCISA.

[Richard Evans]

I think the only distinction I would make is that ours is not a plan; it's actually under way.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

It's under way.

[Richard Evans]

We will be reporting, hopefully by the spring, on that. It's very actively under way. We've received all the information that we've requested from the RCMP. We hope to report, as I say, in the spring.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

It's not necessarily a comfortable state of affairs in some ways. We have two institutions that are at least subject to review and that are currently under review. We have 15 other institutions subject to the act. Thankfully, CSC has not shared information. We're safe there.

I know CBSA has both received and disclosed information. It's not subject to any review. Immigration, IRCC, has both received and disclosed information, and it's not subject to review. Global Affairs has disclosed information, and it's not subject to any review.

I guess my question is this: given that it's an inadequate state of affairs, in my view, going forward, how do you see the review bodies working together to establish that full review? We had professors Roach and Forcese before us to say that government information sharing should be matched with a full review of that information sharing, and they would worry if there's piecemeal review and then no review.

How do you see your offices perhaps working together, or the Office of the Privacy Commissioner working with your offices?

[Pierre Blais]

If I may just go back to my comments on the way it goes with the sharing of information right now, as I mentioned, there are some bilateral agreements between players most of the time.

For example, Global Affairs Canada has a protocol with CSIS, and they're in a process to review it. It's the same thing in place with many others. With CBSA, there is one that they're working on. It is because the exchange of information existed before the law. CSIS has been collecting information for 30 years. You can imagine that they go in many directions to gather information.

Now, speaking for our committee, we encourage CSIS to have specific agreements with the partners, in Canada and outside, for obvious reasons, as I am sure you would understand, to make sure it's done properly and that there's nothing that could fall through the cracks or is not within the law. That's why we do that.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

I'm sorry to cut you off, but I only have a couple of minutes left.

Is it fair to say, though, going forward, that fundamentally you're just reviewing CSIS in terms of its information sharing? Do you view the Privacy Commissioner as playing a role, then, in reviewing all information sharing under SCISA? If it's not through the Privacy Commissioner, how can we adequately review information sharing under SCISA?

[Jean-Pierre Plouffe]

Just to answer your first point with regard to the possibility for review bodies to carry out joint work, right now we can't do that, as noted by my colleague. We work in silos. This is not adequate.

I have stated in the past that it would be desirable to give the existing review bodies explicit authority to co-operate.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

But even there, we have three review bodies and we have 17 institutions. That's a great answer, but unless those three review bodies, working together, have the capacity to oversee all institutions that are recipient institutions and subject to the act, how do we adequately review SCISA?

[Jean-Pierre Plouffe]

With regard to the 14 institutions, as I said previously, in my view it's important that they be subject to expert review one way or the other, or the committee of parliamentarians could decide that they want to do that themselves. It's up to them to decide that, but I still believe they should be subject to expert review.

How do you do that? Again, it's for the government to decide whether it wants to create one super-agency, for example, or whether it wants to divide those 14 institutions among the existing review bodies or create other review bodies. For example, perhaps the CBSA could be reviewed by the CRCC because, with regard to function, there is something similar, and so on and so forth.

Also, I must add that I feel that if the government feels that a super-agency is not in order, at least we should have a coordinating committee of some sort—and this was suggested by my colleague Justice O'Connor 10 years ago—where all the heads of review agencies meet and discuss problems in common. The committee of parliamentarians would be a practical solution, because they would have to deal with one body and not with 14, 15, or 17 institutions. This is what I would suggest.

[Richard Evans]

I'll just add one comment. There is provision in our legislation that serves as a good example. We do have that authority to conduct joint reviews, hearings, and investigations, but our legislation stops short of allowing us to it with our federal partners. We do it extensively in the law enforcement context with our provincial partners. There is a provision in the RCMP Act that allows that, and it works.

[Nathaniel Erskine-Smith, Liberal, Beaches—East York, ON]

Thanks very much.