Public Safety Committee on Feb. 13th, 2018

[Shelly Bruce]

Thank you for your question.

I will answer in English as I am more familiar with the vocabulary in that language.

I agree with Malcolm regarding the environment that we are working in. We're in a space where there is an increasing cyber-threat surface out there. Hostile state actors and non-state actors are using the Internet. We also have rapidly growing and evolving technology based within that space. We also have targets and our own citizens who are using that space, so all three of those combined makes this a very challenging environment for us, but the legislation will provide us with advanced tools and capabilities to address some of these issues. As well, this provides the government with an opportunity for CSE to use its capabilities and expertise for online activities in a way that could thwart or disrupt online threats, before they materialize or become a crisis within Canada.

[The Chair, Liberal, John McKay]

Thank you, Mr. Paul-Hus.

Mr. Dubé, you have seven minutes, please.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you, Chair, and thank you all for being here.

I'll apologize in advance if I seem rude. My time is fairly limited.

Ms. Bruce, you said that mandate is important. Is that a legally defined mandate or the mandate that the organization gives itself?

[Shelly Bruce]

It's a legally defined mandate.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

Thank you.

The Minister of National Defence is the one responsible for the powers that are in this bill. Can someone at the table, then, explain to me why it's been added to a bill that's been tabled by the public safety minister? The public safety minister comes before this committee, and the bill has come to a committee that doesn't necessarily have the institutional memory that the national defence committee would have.

[Malcolm Brown]

The short answer is that I think the decisions about which committee this should go to.... We are merely servants. We come to testify before whoever would like to ask us the questions. It's not for us to opine on the appropriateness of the forum.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I appreciate that, so why were these measures dealing with the CSE specifically included in this bill?

[Malcolm Brown]

Because it's about updating a national security framework that includes the activities of an agency such as CSE.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I appreciate that.

Ms. Bruce, we'll go back to you. Clause 25 in part 3 dealing with the privacy protections.... Some of the words that are used include, “and disclosure of”. The minister has explained that the changes to SCISA that now use the word “disclosure” refer to information already in the possession of different agencies or departments. In other words, when you're talking about the disclosure of information that you're obtaining through this research, does that mean of the information could be shared between different agencies and departments?

[Shelly Bruce]

Go ahead.

[Scott Millar, Director General, Strategic Policy, Planning and Partnerships, Communications Security Establishment]

Hi there.

Just to be clear, right now we share information with other departments and agencies under our existing authorities. When we do that, we do it through an end-product report, an intelligence report. That will continue the way it is now. There are privacy measures in place when we share that information, and those measures are reviewed. In fact, how we do that is reviewed and has been reviewed for 20 years. So this will enshrine the legislation of practice that exists now with CSE.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

I ask because one of the responses to the concerns.... You said that you're not using the information you're collecting under section 24 to create profiles or do any kind of investigation. Does that preclude other agencies from potentially doing the same thing, if you're disclosing the information you've collected to another agency, and it's beyond your mandate to be doing anything yourself with that information?

[Shelly Bruce]

When we say we need privacy measures in the disclosure of information, it means that in the course of our foreign intelligence or cyber-security operations, we may come across an entity, an IP address, an individual, or a company that is unknown to us. So we need to do research from open sources to contextualize that and to make sure we understand what we're dealing with.

If it turns out that the individual, that company, or that IP address is Canadian, then we put in place measures to mask that identity if that information leaves CSE. It's about protecting that information.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

As the bill reads, you “take measures”, but essentially, those are internal.... There's no retention period, for example, which is often something that we see.

Is there any way you can provide the committee with the specific measures you take to protect the privacy of information collected under section 24?

[Shelly Bruce]

As I said, the information that's collected.... Actually, it's not collected; it's consulted. It's research information that we use. If that information is germane to foreign intelligence or cyber-security reporting, then we will include a reference to that. But we would mask it. We would suppress any Canadian information and replace it with a generic term. Instead of listing the Canadian IP address or the Canadian name, we would say “a Canadian person” or “a Canadian IP address”.

[Scott Millar]

I'll just to that add, as well.

Again, we cannot direct our activities at Canadians. We direct them at foreign targets. If a foreign target talks about a Canadian, or, say, calls somebody in Canada and we pick that up, we have to destroy that information under current legislation, if it's not essential for international affairs security and defence. If we do retain it, then we have to count it. We would have to account for the fact that the information had been picked up, the fact that we had destroyed it, or if we had retained it, the reason we had retained it. That's reviewed now by the CSE commissioner.

There are policies and procedures and things baked into our system that we have available on our website in the form of a privacy fact sheet that breaks out all the different measures now in place, and our adherence to those measures is reviewed by the CSE commissioner.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

You'll forgive me, but it's section 24 that specifically says “despite section 23”, which is the one that mentions the prohibition against targeting Canadians or persons in Canada. It says that despite that, you “collect publicly available information for”, and it lists the reasons.

Section 25 mentions these vague notions of measures being taken to protect privacy. Can you point me to the specific part of the bill that explicitly outlines what's done to protect privacy, and the things you're explaining about destroying that information or not keeping it? Insofar as the information collected under section 24 is concerned, I just don't see that.

[Scott Millar]

Right now in the bill, the minister, in the ministerial authorization space, will lay out the privacy measures specific in that authorization on the use, retention, and disposition of that information, and we have to follow that. Again, some of those elements are listed on our website now. I can walk through them. There are policies, procedures, training, and what have you.

I think an important element to underscore is that the only way we would assist other law enforcement security agencies under their mandates is if they came to us with their own lawful authorities—under our assistance mandate—and then we would help them within the bounds of that lawful authority and that activity.

With respect to the kinds of things we're talking about here, for anything that we do in CSE, whether it's our intelligence collection, cyber-security, or dealing with publicly available information, we have to have privacy measures in place. There could be things that engage our privacy interests, so those measures have to be there.

There's a range of things, in terms of privacy measures, for the kinds of general research that we do, the kinds of intelligence-collection activities that we do in support of the Government of Canada's intelligence priorities, and the kinds of things that we do in response to requests from partners.

[Matthew Dubé, NDP, Beloeil—Chambly, QC]

When it comes to—

[The Chair, Liberal, John McKay]

Unfortunately....

I do intend to be a little bit more flexible in the second hour, so I think we can come back on a lot of these issues.

Ms. Damoff, for seven minutes, please.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Thank you, Chair.

I want to follow along the same line of questioning, because I'm still not clear about when Canadians get caught up in this information gathering. I have a couple of questions.

You mentioned that you mask the identity, but you keep it. For how long do you keep that information?

[Shelly Bruce]

CSE does have a retention schedule, but we have not published those retention schedules at this time.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Is it ever destroyed?

[Shelly Bruce]

Oh yes.

[Pam Damoff, Liberal, Oakville North—Burlington, ON]

Is that public?