Thank you so much.
Let me start by thanking you all for this wonderful opportunity and for undertaking the crucial task of reviewing Bill C-59. It is truly indeed an honour and a privilege to be here today and to sit with you.
I have been asked to focus my attention today on part 3 of Bill C-59, the proposed CSE act, and that is what I intend to do. In general, there is no question to me that updating the antiquated authorities governing the CSE and putting the establishment on solid statutory footing is vitally important. As a result, I am strongly in favour of the initiative to craft a CSE act. Indeed, it is obvious to me that the result of this endeavour is a carefully crafted piece of legislation that tries hard to balance the operational needs of CSE to protect Canada's national security interests with Canada's commitment to democracy and the rule of law.
Obviously, given its size and complexity, there will also be much work to do. That simply goes with the territory. In this regard, I have had the distinct benefit of reading the briefs and testimonies of the witnesses that have already presented to this committee. While each guest has offered thoughtful commentary that I encourage you to strongly consider, my overarching sense is that none of us will foresee all the legal or operational challenges to come.
This is the reality of dealing with such a large, important, complex, and highly technical bill. Therefore, more than anything else, it will be vitally important that the current review of the CSE act is thorough and rigorous and that such rigorous review and oversight continues, particularly in the early days and years. This is not an act that should look precisely as it does now, by this summer, or when it is first reviewed, years after coming into force. It will have to be updated to keep pace with technological, operational, and legal developments.
In my mind, the best bet is to focus on robust review and oversight, such that, the issues that do arise in the coming days and years come to the attention of Parliament, to the public, and to the CSE itself, and that there is an opportunity to make the necessary corrections when the time comes.
Neither the law nor Canada's security is well served, if the CSE's legal and/or operational fault lines are kept in the shadows, and it is my sense that the CSE would agree with that sentiment. For this reason, I would start by encouraging you to adopt Professor Kent Roach's recommendation that the review contemplated in part 9 of the act take place sooner, rather than later.
The same goes for the CSE Commissioner's recommendation with regard to the need for the proposed intelligence commissioner to produce an annual report on his or her authorizations, to be tabled in both Houses yearly. Also, there is the need to ensure that any activities that implicate a reasonable expectation of privacy, and thus implicate section 8 of the charter, by necessity, are properly overseen by the intelligence commissioner.
Here, I have three things in mind. First, the CSE Commissioner has recommended that proposed section 37(3) of the CSE act be amended to require the IC approval of ministerial authorizations to extend foreign intelligence operations. Indeed, if the original operation requires IC approval, so too should any follow-up. Arguably, the IC will have more information on which to base a decision at this re-authorization stage. More to the point, it is at this later stage that we will really see whether, and how much, incidental collection of Canadian content is forming a part of the foreign intelligence collection.
This brings me to my second point fairly neatly. I encourage you to focus your legal review of the proposed CSE act on those sections that implicate the collection of incidental information not, as we commonly say, directed at Canadians. In the past, including recently in both the U.S. and Canada, we have seen that lack of oversight over just this sort of incidentally collected information can cause great legal and political controversy that I don't believe anyone is looking for.
In the context of the proposed CSE act, I would then encourage you to adopt Professor Craig Forcese's call to amend subsections 23(3) dealing with the collection of foreign intelligence, and 23(4) dealing with cybersecurity. CSE is made to seek ministerial authorization, and thus IC oversight, where its activities will contravene an act of Parliament, as it currently states, or involve the acquisition of information in which a Canadian or person in Canada has a reasonable expectation of privacy.
Our charter demands oversight where there is a reasonable expectation of privacy. Therefore, it is very hard to see how, without ministerial authorization and IC oversight, the bulk collection of information that implicates the reasonable expectation of privacy, which under the current wording could be permitted, would hold up in any court of law in Canada.
Third and finally, I believe that you have heard testimony that has expressed concern about the collection of publicly available data, without the oversight of the IC. I'd be happy to provide more detail here during the question period. For now, I will simply say that one can certainly be sympathetic to the carve-out for publicly available data. If the public can access it, surely there is no need for the CSE to get approval to do the same, or so the theory might go.
But not all publicly available information is the same, and bulk publicly accessible information in the hands of the state is a very different thing indeed from that information in the hands of an individual like you or me. For example, unlawfully obtained information, hacked passwords for example, can become public but nevertheless will also be thought of as private information—at least in the eyes of those who hold those passwords. Moreover, discrete pieces of public information may seem harmless on their own, but when harnessed together by the state to produce big data analytics that can also be publicly purchased and then collected as one piece of information, the amalgam of public information can offer very private insights into the lives of individuals. Of course, all of this adds to the thinking, which is already present with respect to some publicly available information, that in the right context public information can itself implicate a reasonable expectation of privacy and thus implicate section 7 of the charter once again.
Put another way, just because it was accessed publicly, does not mean it doesn't implicate the privacy protections of our charter. This will, of course, have ripple effects for how that information can be used and shared. With IC oversight, for example, such private “public” information might be shared with the RCMP for prosecutorial purposes. Without IC oversight, information collected in violation of the charter will not likely be able to be used in support of such prosecutions.
In short, unless CSE's collection of public information is brought under the purview of the IC, there is real reason to fear that we have both a security and a liberty concern here.
Thank you very much for your time.