Information & Ethics Committee on Feb. 2nd, 2017

[Dominic Rochon]

It's a complicated question.

In terms of the information we collect in our foreign signals intelligence mandate, we need to make sure that it meets with an intelligence priority as set by the government, that it pertains to international security and defence. That's sort of our staple.

We also have to, obviously, make sure that it's directed at non-Canadians outside of the country. Those are the staples in terms of what it is that we're collecting and the threshold that we're measuring.

From there, we assess that information and then we disseminate it. The litmus test is that our clients in the RCMP, CSIS, and other departments and agencies will then provide feedback to let us know whether that information was useful.

As far as foreign intelligence is concerned, we don't have any investigatory powers. We don't have any powers of arrest. We just provide foreign intelligence, and all of our foreign intelligence is caveated with the fact that it stems from our collection capabilities and what we were able to collect. We're ultimately, in part (a) of our mandate, not assessing. There are other parts of the government that will take our information, fuse it with other intelligence from other parts of the security intelligence apparatus, and then ultimately come up with the assessment.

[The Chair, Conservative, Blaine Calkins]

Thank you very much, Mr. Dusseault. We're well over time, but I appreciate that.

For the last of our seven-minute round, we'll go to Mr. Saini, please.

[Raj Saini, Liberal, Kitchener Centre, ON]

Thank you very much for being here today. I want to pick up on my colleague Mr. Dusseault's point about retention of information. I think this is a technical question. This may be applicable to some of you and not to some of you.

You might receive information that might be relevant, that might be actionable, and you might receive information that might be redundant or might not be used. Madame Paquet said they keep it for two years. When you retain it, what is the protocol for keeping that information? What is the protocol if that information it is not actionable, is not relevant? How do you dispose of that information?

[Stephen Burt]

I can take a crack at that.

Much as I think Mr. Rochon will probably tell you, in the context of our operations abroad, the issue of holding onto information is a bit of a different set of questions. We're not dealing with information that is necessarily touching on individuals in the same way. Information can be databased for quite a long time, because you want your analysts to be able to go back and cross-check things and figure out what has happened in the past on certain files.

There are not the same kinds of timelines that there would be when you're dealing with private information, whether it's of staff or people who you're regulating, or if you were dealing with legal cases or national security investigations regarding Canadians where there are privacy concerns. For the vast majority of what we collect in terms of operational information, there is no formal process around how long you can keep it. The goal is to database it usefully so that you have good information to look back upon.

[Dominic Rochon]

I would agree with that.

It's very similar in terms of our foreign signals intelligence activities as well as cyber-threat activities. If we've collected information that's useful and there's an ongoing threat, we're going to continue to use that information. Obviously, we're not in the business of collecting information about Canadians. Not to get too technical, but we do come into contact with information. We may collect it incidentally. We have very strict rules that we are to delete that information immediately unless it has value with regard to a threat to Canada. If we can show that it does have that value, and there's an interest when it comes to the security and defence of Canada, then we will keep it and we'll report on it. However, we still put measures in place to protect that information within our systems.

Specifically, as it pertains to retention periods, your question is more about how long we retain things. We have retention periods for most of the collection of information that we have. We have ministerial directives that impose those retention periods. We follow them and they are reviewed by our commissioner to make sure that we adhere to them. That's how I would couch it.

[Raj Saini, Liberal, Kitchener Centre, ON]

Do you have anything to add?

[Marie-France Paquet]

I'll just add that on the aviation security side, we get information on the advance passenger manifest, as we call it. We keep that information for only seven days.

[Raj Saini, Liberal, Kitchener Centre, ON]

Then you destroy it after exactly seven days.

I'm sure some of you have also written sharing agreements with foreign governments and foreign entities. Do you deal with any kind of information that involves the privacy of Canadians?

[Stephen Burt]

It's a bit like what was just said. Occasionally, you would come across that information incidentally. It does happen on deployed operations that you would come across things that do or may impact on Canadians. When those cases occur, we hand them over to the appropriate Canadian authorities. We would do that regardless of SCISA.

SCISA provides a good framework for doing it. In fact, the one case that we have had involved exactly that kind of information that came from a foreign partner and was relevant to CSIS's mandate.

[Raj Saini, Liberal, Kitchener Centre, ON]

You don't send Canadian information abroad. It comes to you.

[Stephen Burt]

We don't collect Canadian information intentionally.

[Dominic Rochon]

We don't collect the Canadian information, and we wouldn't be sending specifically private communications about Canadians. That being said, we're part of a Five Eyes, cryptologic, long-standing arrangement. We have a long-standing agreement that we don't conduct activities on our citizens, and we don't conduct activities on their citizens and vice versa. It's a long-standing protocol, and it has served us in good stead for about 70 years now. That being said, when you say “information”, it gets a little bit more complex in terms of what it is that we do because there's the whole issue of metadata.

Nevertheless, if there's an exchange of information that may or could involve a Canadian, we have measures in place that protect that information. Therefore, we render that information unintelligible, as I mentioned in my opening remarks. If it does get passed on, any information about a Canadian would be rendered unintelligible, so they wouldn't be able to see it. If they wanted to see it, they would have to come back and explain to us that they have an imminent threat and ask for the personal information. Then we would make an assessment as to whether or not we could share it.

[Raj Saini, Liberal, Kitchener Centre, ON]

The other question I had is, do you ever use warrants or anything to obtain any kind of information? Maybe specifically not you, because you deal with foreign information, but do any of your organizations use warrants?

[Stephen Burt]

My organization does not use warrants. Occasionally, if we are operating in support of a domestic law enforcement agency, we'll be authorized under a warrant by them, and all the rules of that warrant will apply. That's when we're working in support of them, and effectively we're part of their organization for those purposes.

[Dominic Rochon]

That's exactly the same.

Part (c) of our mandate essentially gives us—

[Raj Saini, Liberal, Kitchener Centre, ON]

You don't use warrants on your own. You use it as part of another thing.

[Dominic Rochon]

Correct.

[Donald Roussel]

For us, it's not within that context that we will use a warrant. It will be under compliance and enforcement, under the safety regulations in particular where we're seeking information. It's not necessarily on individuals but on the operations of a company, the bookkeeping and so forth. It's not under the security mandate.

[Raj Saini, Liberal, Kitchener Centre, ON]

Thank you very much.

[The Chair, Conservative, Blaine Calkins]

Okay. Thank you very much, Mr. Saini.

We now move to our five-minute round, colleagues. We'll go to Mr. Kelly, please.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Thank you, Mr. Chair.

On Tuesday, we had witnesses who made claims that would indeed be very disturbing if the substance of these claims were true. I'm going to ask you to confirm whether some of the things that were said about threats to the privacy of Canadians, and specifically about SCISA, are correct or not.

A concern was raised about bulk data collection and bulk data sharing between listed recipients, in contrast to a nuanced or targeted collection and sharing approach. I'd like you to comment on what bulk data collection and sharing means, and whether Canadian agencies and organizations do it.

Specifically, it was stated on Tuesday that, under SCISA, there's no limit on data sharing and no oversight. It was characterized as a blank cheque for Canada's national security agencies. It was stated also, as an example, that CSIS could go to the RCMP and ask for all the information it collected under warrants, but once in CSIS's hands, the information would not be subject to the conditions set out in the warrant. It was claimed that Canada hoovers up as much information about innocent people as possible through bulk data collection instead of a targeted approach.

These were some of things we heard in Tuesday's committee meeting. I would like each of you to comment on those claims, and whether these are legitimate concerns about privacy under SCISA.

[Stephen Burt]

I'm happy to go first on that.

It's clearly stated in the legislation that SCISA does not affect collection mandates whatsoever, so there is no net effect of SCISA on collection of any kind, bulk or otherwise.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay. These appear to be gross exaggerations or mischaracterizations of the powers under SCISA.

[Stephen Burt]

To simply state what's in the act, in terms of sharing I would say what SCISA brings to the table is a clear framework with a couple of tests in it for whether or not the information can be shared. It's a very short piece of legislation. It's written very clearly, and the tests, I think, are laid out with some precision in terms of the wording.

It facilitates sharing, certainly. That was the intent of the act.

[Pat Kelly, Conservative, Calgary Rocky Ridge, AB]

Okay.

Mr. Rochon.