Evidence of meeting #90 for Public Safety and National Security in the 42nd Parliament, 1st Session. (The original version is on Parliament’s site, as are the minutes.) The winning word was privacy.
A video is available from Parliament.
9:40 a.m.
Conservative
Dave MacKenzie Conservative Oxford, ON
Okay. I appreciate that.
In looking at this legislation, as you have, how do you compare it, if you have done so, with that of our allies in the same businesses we are dealing with here, counter-intelligence and terrorism, particularly, I guess, that of the Five Eyes?
9:40 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I think that on the whole this legislation would allow Canada to catch up to the Five Eyes. Particularly this, plus Bill C-22, with the committee of parliamentarians, would allow some catching up, perhaps getting us near the front of the pack.
9:40 a.m.
Conservative
Dave MacKenzie Conservative Oxford, ON
Okay.
I'd like to go back very briefly to the destruction at 90 days. I think you would appreciate, as most would, that once the destruction has occurred, it's very difficult to reassemble the information.
How do we balance that for our security agencies?
9:40 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Absolutely I appreciate that. That's why I say that the standard applied by the Federal Court at that 90-day stage is not a necessity. Perhaps somebody can help me with the standard, but it's essentially whether information would be useful for a national security investigation. That's a way to ensure that potentially useful information is not destroyed too early.
9:40 a.m.
Liberal
Peter Fragiskatos Liberal London North Centre, ON
Thank you very much, Mr. Chair, and thank you for being here today, Mr. Therrien.
I have a question about the connection between speech and privacy. I think you would agree that free speech and the right to it and to privacy enjoy a very intimate and indeed interdependent connection. Bill C-59 would replace one of the most controversial features of Bill C-51, the advocating of terrorism offences in general, with a more traditional offence, that of counselling specific terrorism offences.
We heard just the other day from Professor Stephanie Carvin, who in a piece for The Globe and Mail, wrote:
This better respects freedom of expression while still recognizing that much speech — including terrorist recruitment and instruction — is a reasonable target for criminalization.
Can you comment on this change in Bill C-59 and what you make of it from a privacy perspective?
9:40 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
I would agree; I don't have much to add to the analysis of Professor Carvin. To be frank, I focused more on SCISA, because it's the weakest part. I have noted, of course, the provision you are referring to, and I think it is an improvement inf terms of striking the right balance between freedom of speech, privacy, and ensuring the security of Canadians.
9:45 a.m.
Liberal
Peter Fragiskatos Liberal London North Centre, ON
In your comments—and you followed up on that matter—you made the point about privacy experts being involved with the NSIRA. Can you go into that a little further? Are we talking about an oversight role to ensure that the Privacy Act's provisions are being followed? You talked about examples specifically relating to travellers, but are there other examples you could mention to give us an idea of how officials focusing on privacy could have a role in such a body?
9:45 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
Sure.
Yes, the application of the Privacy Act would be part of this, as would the lessons learned in the application of the Privacy Act otherwise in government to national security agencies. I think it's important that national security agencies be covered by specific rules, as in Bill C-59, but also by the legal regime of the Privacy Act, because these are emanations of the state, and as with all emanations of the state, they should be covered to the general rules applicable through the Privacy Act.
As an example of how we might add value, about two years ago we reviewed an incident involving the unfortunate but unlawful disclosure of metadata by the CSE to the Five Eyes. We played a very specific role. We did not look at all of the situation, but we looked at sufficient parts of it to examine the importance of metadata to privacy. We were able to look at the deficiencies, make recommendations on how to improve things, and play a public education role to make sure that the public was informed of the importance of metadata for privacy protection. That's something we added.
9:45 a.m.
Liberal
Peter Fragiskatos Liberal London North Centre, ON
Thank you very much.
I have one final question. You wrote an overview of C-51 in The Globe and Mail shortly after the bill was released. You said, “In a country governed by the rule of law, it should not be left for national security and other government agencies to determine the limits of their own powers.”
On balance, are you satisfied that Bill C-59 has addressed this concern?
9:45 a.m.
Privacy Commissioner of Canada, Office of the Privacy Commissioner of Canada
On balance, Bill C-59 makes important improvements, but the recommendations I am making, particularly on the necessity threshold and legal safeguards for retention or destruction, are necessary to achieve the right balance.
9:45 a.m.
Liberal
The Chair Liberal John McKay
Thank you, Mr. Fragiskatos.
On behalf of the committee, Mr. Therrien, I want to thank you and your colleagues for your very thorough presentation and just remind you that there was some undertaking to Mr. Paul-Hus concerning the survey, which I will look forward to receiving.
With that, we'll suspend.
9:50 a.m.
Liberal
The Chair Liberal John McKay
I call the meeting back to order.
We have in our next set of witnesses the Canadian Civil Liberties Association, and as individuals Christian Leuprecht and Hayley McNorton.
Unless you have any other way of ordering this, I am simply going to go in the order of the Canadian Civil Liberties Association first, Christian Leuprecht second, and Hayley McNorton third.
Is the Civil Liberties Association ready to go?
9:50 a.m.
Brenda McPhail Director, Privacy, Technology and Surveillance Project, Canadian Civil Liberties Association
I'm sorry, Mr. Chair. Cara Zwibel has just stepped out. She'll be here in just a moment. We would ask that someone else go first.
Thank you.
9:50 a.m.
Dr. Christian Leuprecht Professor, Department of Political Science, Royal Military College of Canada, As an Individual
We'll do it in two parts here. I'll set the scene, and then Ms. McNorton is going to explain the specific recommendations we have. I have copies of these. I have submitted them to the committee for translation, but I'm happy to circulate the documents.
9:50 a.m.
Liberal
The Chair Liberal John McKay
We should have you go first and Ms. McNorton second, and then we'll go back to the Civil Liberties Association.
Thank you.
9:50 a.m.
Professor, Department of Political Science, Royal Military College of Canada, As an Individual
Mr. Chair, I think we need to ask ourselves why we are here. I think one of the challenges we've had is that we hear a lot of tactics, but we don't hear a lot about what the strategy is and what the ultimate rationale is behind this. The rationale is that, as Canadians, we've long lived in an environment where we believed we have been safe by virtue of where we are in the world, which is very far away from all the troubles in the world. I would submit that this is no longer the case. The fundamental conditions have changed. The security threats and vectors are much broader and much deeper than they have ever been.
If you think about hypersonic manoeuvrable cruise missiles, intercontinental ballistic missiles, cyberspace, violent extremism, terrorism ideology, and also matters such as the globalization of organized crime, these are all things that we can't just keep away from our borders. They affect us here now, and they affect us every day. The security environment has fundamentally changed. The premise that we're somehow safe because we're far away from the troubles in the world simply no longer applies.
We've also, of course, seen these threats specifically associated with certain entities. This is often what's referred to as the four-plus-one issue: the four countries—China, Russia, North Korea, and Iran—and the plus one is transnational terrorism. In Canada we don't have a systematic human foreign intelligence service, so we rely disproportionately on our signals intelligence service to provide us the foreign intelligence we need to get domain awareness.
We also have the benefit of being part of the Five Eyes community. This membership should not be taken lightly. There is an international security hierarchy in the world. If you think about this as a pyramid, the United States is at the top and the Five Eyes community is below that. That means we need to be able to continue to be effective contributors to that community if we want to benefit from that community. The benefit from that community has precisely been that we have been able effectively to underinvest relative to most of our allies in defence, in security, and in intelligence because we have this force multiplier capability of domain awareness and overcoming the fallacy of composition that we wouldn't otherwise have. We need to balance here our obligations and the benefits to the community with the constraints that we impose on our own community.
We've also seen a fundamental change in the intelligence business as a result of two events, if you will. One is the advent of the Internet and of large data. The bad guys have been exploiting those systematically, and I would submit that in Canada we have been a little bit too easy on the bad guys who exploit the Internet and data, and too hard and making life a little bit too difficult for the people who are actually trying to disrupt, rein in, detect, and defend us against these nefarious entities. We need to strike a balance between the good guys and the bad guys. Of course, the advent of 9/11 has fundamentally changed the intelligence community and also the expectations the public has of the state in terms of keeping them safe and secure.
More than ever before, in light of the threats I've outlined, we are relying on intelligence to help us anticipate the security and safety challenges for Canada and to be able to mitigate those challenges effectively.
My fourth and final submission on this point is that, as a result of the Snowden revelations, much of the public has some skepticism about how the community operates. We are not here because there's in any way some large-scale violation of the professionalism or the capabilities in which the community does its job. We have the odd issue that comes up. Usually those issues are first identified by the community itself and then brought to the appropriate offices. We have a professional community, but we have the public that is skeptical, so I think the primary purpose of review here is to reassure the public that in a rule-of-law society and in a constitutional society everything is indeed on the up and up.
The other problem is that we have a massive public misunderstanding of what the community does, why it does it, and how it operates. That's as a result of the media, because where we see the community operate is largely on television where there are shows about law enforcement, intelligence, terrorism, and whatnot. If you watch those shows about the systematic violations of the rule of law and of constitutionalism, it makes for great television, but it is simply not how the community operates. However, this is what most Canadians and much of the public think is happening, reinforced by some of the ways the revelations by Edward Snowden have been interpreted and misinterpreted in much of the public discourse.
I would also say we need to be careful, then, in Canada with the security culture that we've created. In the Five Eyes community, we have, by far, the most restrictive privacy regime. This is a choice that we have made as Canadians, that what we are doing here is.... Other countries that have more rigorous parliamentary and other review mechanisms than Canada have also given their community more latitude in terms of how it can act, what it can do, and how it can do it.
In Canada, I'm a little concerned that, on the one hand, we're imposing considerable constraints on the ability of the community to be agile and flexible to continue to reassure the safety and security of Canadians, while at the same time, imposing this very strict review regime which, yes, is necessary to reassure the public, but we need to make sure we strike an effective balance here.
I hear lots of people constantly talk about privacy as if review were only about privacy, which, of course, is nonsense. There is review; there is oversight, yes, and there is compliance review, but review is also about efficacy. Are Canadians getting what they pay for from the community? Currently, nobody is really able to ask that question. We will now, as a result of these mechanisms, have the ability to ask those questions, and effectively, these committees will also be peer review for the community. Are they doing the best job they possibly can with the best methods and the best approaches that are available to them?
This discussion that it is simply about privacy, to me, misconstrues the broader benefits and payoffs of a more robust review regime by parliamentarians and by the now-revised community of review bodies that will have a broader remit overall.
I'll close on six questions that we need to ask ourselves when we try to introduce this type of legislation. What are the methods that should be used to hold the intelligence and security agencies to account? What ISAs, intelligence security agencies, should fall in the remit of those accountability bodies? Who is staffing those accountability bodies? What relationship does the accountability body have with the political executive? To what information does the accountability body have access? If there is more than one accountability body, how do they coordinate, and how do they prevent duplication?
This dovetails now with Ms. McNorton's recommendations that follow directly from some of these issues that we have laid out here that people need to think about when we implement such legislation.
9:55 a.m.
Hayley McNorton Research Assistant, Department of Political Science, Royal Military College of Canada, As an Individual
Mr. Chair, to enhance intelligence accountability, we have suggested five recommendations.
The first is that Bill C-59 does not describe if and how NSIRA, which is the national security and intelligence review agency, will support the National Security and Intelligence Committee of Parliamentarians. In the existing system, the committee of parliamentarians could apply to OCSE, the office of the CSE commissioner, the Security Intelligence Review Committee, or the Civilian Review and Complaints Commission, if they needed additional assistance. However, if Bill C-59 is passed, it will only apply to NSIRA or the CRCC. In regard to this recommendation, we consider how much support NSIRA will give the committee of parliamentarians and what kind of support they will give the committee of parliamentarians.
The second suggestion is that the Civilian Review and Complaints Commission should retain its ability to review issues and investigate complaints related to national security. The existing legislation giving NSIRA the ability to review matters related to national security issues goes against the recommendations from the O'Connor commission. Also, in the end, it would give the CRCC undue influence over what NSIRA reviews in regard to national security, because NSIRA will remain the principal point of contact for the complaints and reviews, which it would then refer to NSIRA.
The third recommendation is that NSIRA should have the ability to conduct joint investigations with provincial police and complaint bodies. The CRCC has this power as well. Basically, a lot of the federal intelligence and security agencies work with provincial police bodies, so that is also a consideration.
NSIRA should develop and establish standards for intelligence accountability.
Last, NSIRA should take reasonable steps to co-operate with the committee of parliamentarians to avoid unnecessary duplication of work in relation to the fulfillment of their respective mandates.
10 a.m.
Liberal
The Chair Liberal John McKay
Thank you very much.
I see the Civil Liberties Association. I assume you're ready.
10 a.m.
Cara Zwibel Acting General Counsel, Canadian Civil Liberties Association
Yes, my apologies to the committee for coming in late.
Thank you, Mr. Chair, and members of the committee. The Canadian Civil Liberties Association appreciates the opportunity to make submissions with respect to Bill C-59.
CCLA was a vocal critic of the Anti-terrorism Act passed in the last Parliament and initiated a constitutional challenge to a number of aspects of that law, which remains in abeyance pending consideration of Bill C-59. While this new bill has partially addressed some of Bill C-51's constitutional deficits, it has certainly not resolved all of them. The bill also grants our national security agencies a number of extraordinary new powers that have not been adequately justified and that do give rise to very real civil liberties concerns. The government has framed this bill as being about protecting both national security and rights, and CCLA supports both of these goals, and our comments and recommendations are made in that spirit.
We will begin by identifying the positive changes Bill C-59 makes to former Bill C-51, outline the issues that remain unaddressed, and finally, set out the new problems created by Bill C-59.
Since we certainly can't cover everything in 10 minutes, we'll also be filing a more detailed written submission. Beginning with the items that Bill C-59 has improved, we are reassured by the government's amendments to the terrorist speech offences. Without these amendments, the provisions violate sections 2 and 7 of the charter and may also undermine community-based deradicalization efforts. While the amended offence is arguably unnecessary, given the large number of pre-existing terrorism offences in the Criminal Code, counselling offences are a known quantity in the criminal law and follow a clear legal framework. However, the language of “terrorism offence” in the amendment would be better changed to “terrorist activity”, which is a defined term in the code.
On information sharing, Bill C-59 adds new proportionality and reporting requirements, which is a distinct improvement over the largely unaccountable system introduced in Bill C-51. However, the definition of “threats to the security of Canada” that triggers information disclosure remains unduly broad and circular. It is not clear why this definition is so much broader than the one included in the CSIS Act, and we remain concerned that constitutionally protected acts of advocacy, protest, dissent, or artistic expression, particularly by environmental and indigenous activists, will continue to be swept up in the process.
One of the most controversial aspects of Bill C-51 was the threat reduction powers granted to CSIS and the accompanying warrant provisions that appeared to allow for judicially sanctioned charter breaches. We do not doubt that there are times when CSIS may see an opportunity to take action to reduce the threat to the security of Canada. What is unclear is why this goal cannot be achieved through better communication and co-operation between CSIS, the RCMP, and other law enforcement bodies. This is a very significant shift in mandate that appears to ignore the historical reasons for separating law enforcement and intelligence in the first place, and there has been no convincing case made for why this shift is necessary.
Moreover, the legal framework for the exercise of these powers established in Bill C-51 was deeply problematic and clearly unconstitutional in our view. The scheme as modified by Bill C-59 is an improvement. It establishes clearer contours around what actions are permitted and what is prohibited, and the warrant scheme appears to be intended to ensure that the charter rights of individuals are respected. If CSIS is to continue to have these powers there are a number of ways in which we believe the scheme should be improved.
First, the requirement for CSIS to consult with other federal departments or agencies to see if they can reduce the threat should be amended to clarify that if a law enforcement body is better placed to do so, CSIS should not pursue threat reduction. Second, the list of measures set out in proposed section 21.1(1.1) only require a warrant where CSIS determines that they may violate the law or limit a charter right. A warrant should be required in any case where these measures will be pursued by CSIS. It is vital that the determination of whether a law is being violated or a charter right limited not be left solely to CSIS.
Finally, the new national security and intelligence review agency should be required to report on the number of warrants issued under proposed section 21.1, and the number of requests that were refused. SIRC does so now, and reducing reporting requirements is not consistent with Bill C-59's stated goal of enhancing accountability.
Some of the most problematic aspects of Bill C-51 received only cosmetic improvement or none at all. As this committee is aware, the passenger protect program continues to raise serious constitutional problems. The process by which individuals are placed on the list remains opaque, and proposed redress mechanisms are inadequate. Bill C-59 also fails to correct the flawed appeals procedure, which parallels the system in place for security certificates prior to the Supreme Court's Charkaoui decision in 2007.
While the no-fly list is undoubtedly different from being named in a security certificate, both have the ability to substantially interfere with the constitutionally protected rights and liberties of an individual and to seriously impact their lives and families. The current process allows the use of hearsay and secret evidence, without access to a special advocate able to test that evidence or to represent the interests of the listed person.
This committee recognized these profound issues in May when it recommended the use of special advocates in no-fly list proceedings, among other safeguards, and yet Bill C-59 does not address these concerns. It should do so by adopting this committee's initial recommendation. We would note that the terrorist entities list raised similar issues.
December 7th, 2017 / 10:05 a.m.
Lex Gill Advocate, National Security Program, Canadian Civil Liberties Association
Mr. Chair, another deeply problematic aspect of Bill C-51 that has not been touched are changes to the Immigration and Refugee Protection Act that undid important protections for named persons in security certificate proceedings. Bill C-51 limited the requirement for disclosure of relevant information to special advocates and introduced a series of procedural barriers which further disadvantaged the rights of the named person.
In our legal challenge, CCLA has argued that these amendments are an unconstitutional violation of the section 7 guarantee to a hearing before an independent and impartial tribunal. Our Supreme Court has affirmed that the individual named in the security certificate “must be given an opportunity to know the case to meet, and an opportunity to meet the case”, an impossible exercise in the absence of a coherent legal framework for full disclosure.
This committee recognized as much in May 2017 when it recommended amending IRPA in order to give special advocates full access to complete security certificate files. We urge that Bill C-59 be amended to correct this issue.
We move now to the new elements of the new national security landscape that Bill C-59 has introduced. Our written submission will address a much wider range of issues in relation to the CSE Act, but we would like to highlight two parts today.
First, the proposed active and defensive cyber-operations aspects of the CSE's mandate essentially allow the establishment to engage in secret and largely unconstrained state-sponsored hacking and disruption. The limitation of not directing these activities at Canadian infrastructure is clearly inadequate given the inherently interconnected nature of the digital ecosystem. Such activities are also bound to impact the privacy expression and security interests of Canadians and persons in Canada, and may threaten the integrity of communications tools such as encryption and anonymity software that are vital for the protection of human rights in the digital age.
In the case of CSIS's disruption powers, which are in some ways analogous to these new aspects of CSE's mandate, the government has set out a complex framework for prior judicial authorization and a longer list of prohibited activities. While we do not concede the adequacy of that framework, it is notable that, in contrast, CSE's cyber-operations activities involve no meaningful privacy protections, require only secret ministerial authorization, and involve only after-the-fact review.
Second, while the majority of CSE's activities cannot be directed at Canadians or persons in Canada, this is an inadequate safeguard against CSE's overreach in the face of unselected bulk collection. Bill C-59 exacerbates this privacy risk by creating a series of exceptions for the collection of Canadian data, including one which allows its acquisition, use, analysis, retention, and disclosure, so long as it is publicly available.
This definition is so broad that it plausibly includes information in which individuals have a strong privacy interest, and potentially allows for the collection of private data obtained by hacks, leaks, or other illicit means. Furthermore, it may encourage the creation of grey markets for data that would otherwise never have been available to government—a client with deep pockets.
The government has failed to demonstrate why this exception, as worded, is necessary or proportionate, or what risk it is meant to mitigate in the first place.