accountability

NSICOP’s 2022 Annual Report

/ Christopher Parsons
Photo by Pixabay on Pexels.com

On July 19, 2023 the National Security and Intelligence Committee of Parliamentarians (NSICOP) released its annual report. The report continues the committee’s work of providing transparency around a number of the national security activities which are undertaken by the Government of Canada. This report assumes heightened importance because NSICOP’s authorizing legislation is now expected to undergo a 5-year review; this report is helpful in understanding what kinds of legislative reforms the Committee, itself, believes are important so as to maintain or enhance Canadian residents’ trust in the country’s national security agencies.

In this post I summarize the challenges that NSICOP believes face it, its proposed legislative reforms, and then briefly itemize notable aspects of reviews that are either underway or which have been concluded. Ultimately I believe that we can firmly state that NSICOP’s work has revealed important aspects of the Canadian national security community’s operations that were hitherto secret and, as such, the Committee’s members and staff are to be congratulated on their efforts over the past five years.

Challenges Facing NSICOP

NSICOP is reporting two key challenges.

First the government is not legislatively required to reply to the recommendations that are included in NSICOP’s reports. These recommendations are issued with the intent of “strengthening the policies, operations and accountability of the security and intelligence community.” While they may sometimes require the federal government to undertake additional activities NSICOP is hardly a ‘gotcha’ review body.

To its credit the government has begun to respond to some recommendations but the majority of those made by NSICOP have yet to be publicly taken up. Beyond indicating the effectiveness of NSICOP’s work—and thus ensuring that the public knows that NSICOP isn’t a paper tiger—responses from the government are important for unmasking some of the secrecy surrounding national security activities. Residents of Canada largely lack insight into the government’s national security policies. NSICOP’s recommendations, and how the government responds to them, provide some degree of light into an otherwise very dark and shadowy world.

Second the Committee is warning (again) that there is a serious issue around obtaining information to which the Committee is lawfully entitled. There are three stated situations where information is not being disclosed to NSICOP:

  1. Some departments have cited reasons outside the statutory exceptions found in the National Security and Intelligence Committee of Parliamentarians Act for not providing information that the Committee requested in past reviews
  2. Some departments selectively refused to provide relevant information, such as a departmental study, despite the Committee’s right of access under its enabling legislation
  3. The Committee is concerned that an overbroad legal definition of what constitutes a Cabinet confidence has had an impact on the Committee’s reviews

For any review agency to function it requires access to information that it is lawfully entitled to obtain, so as to assess agencies’ activities and provide meaningful recommendations or take other actions under its mandate. It is concerning that, in at least some cases, NSICOP reports that information it sought directly from organizations was only discovered through different sources, be they indirectly from third-party organizations or even from records released publicly under the federal Access to Information and Privacy regime.

Readers would be advised to consider the implications of the challenges facing NSICOP, and then place them alongside recent efforts by the National Security Intelligence Review Agency (NSIRA) to include a confidence statement with its recent reports due to NSIRA’s own challenges in sometimes obtaining the information it required to undertake its legislatively-mandated review functions. That both agencies have reported challenges in accessing documents raises questions about the review maturity of organizations which are now subject to national security review.

Proposed Legislative Reform

From a legislative reform standpoint, NSICOP is indicating that it will make two central submissions when called to discuss reforms to the NSICOP Act.

First, it will ask that the NSICOP Act be reformed to confirm that the Committee and its members can get improved access to information and, also, be able to better exchange information with other review bodies. This latter call—improved exchange of information—is notable and worth considering: where regulated agencies can coordinate amongst themselves it is imperative that their review agencies can, similarly, coordinate and exchange information. Such exchanges between review agencies serve multiple purposes, including:

  • sharing information relevant to a review
  • enabling better deconfliction processes
  • letting review agencies better coordinate when they are simultaneously examining the same subject from the slightly different perspectives associated with their respective mandates.

Second, NSICOP is stating that it will request legislative changes to better align its composition with the United Kingdom’s Intelligence and Security Committee (ISC). Specifically, NSICOP believes that becoming a body of Parliament (and not of the executive branch) would “enhance the independence and efficiency of the Committee.”

For clarity, the UK’s ISC is a committee of Parliament with a statutory responsibility for the oversight of the UK intelligence community. In shifting to this model NSICOP would no longer operate within the executive branch—and, thus, perceived as being subject to executive capture—and enable members of the public as well as parliamentarians to recognize that the Committee’s members were not being gagged or otherwise manipulated by merit of NSICOP being housed within the executive branch.

The decision to create NSICOP as an executive branch body was seen at the time as a way to slowly develop trust and capacity between parliamentarians and reviewed intelligence agencies, as well as guaranteeing that parliamentarians did not inappropriately handle information. Some who once called for NSICOP to be within the executive have, since, shifted perspectives and believe it should be turned into a parliamentary body. It remains unclear, however, whether the federal government similarly believes this would be an appropriate modification to NSICOP.

Both of these reforms would constitute significant shifts in the ability of the Committee to undertake its activities and will deserve careful and close thought, and assessments of the extents to which these reforms would genuinely enhance NSICOP’s capacity to fulfill its mandate.

Recent and Underway Reviews

2022 saw NSICOP complete or initiate a number of notable reviews. These include:

  • A Special Report on the Government of Canada’s Framework to and Activities to Defend its Systems and Networks from Cyber Attack (Completed)1
  • A Special Report on the National Security and Intelligence Activities of Global Affairs Canada (Completed)
  • A review of the lawful interception of communications of security and intelligence organizations and the “going dark” challenge (Ongoing)
  • A review of the RCMP’s Federal Policing mandate (Ongoing)

None of NSICOP’s proposed reviews in 2022 were deemed injurious to national security, nor was information denied to the Committee based on these grounds. Twelve agencies were required to provide a copy of their annual reports as required under the Avoiding Complicity in Mistreatment by Foreign Entities Act. Twelve provided them to NSICOP, though they are not reviewed or assessed in the annual report.

NSICOP did not receive any referrals by minister of the Crown to undertake a review of a national security or intelligence matter.

A Special Report on the National Security and Intelligence Activities of Global Affairs Canada

This special report was tabled in November 2022. The annual report notes that “significant weaknesses” were found around Global Affairs Canada’s (GAC) internal governance of its foreign policy coherence role. Namely, this included a lack of “policies and few oversight committees” which NSICOP worried “may introduce weaknesses into the government’s assessment of foreign policy risk.” There were, also, concerns around the lack of Ministerial direction about how GAC collected intelligence around the world. There was also no formal process by which GAC informed its Minister of how it plays a role in relation to CSIS’ collection of intelligence. Relatedly, NSICOP was concerned by “the near total absence of governance and formalized reporting to the minister regarding GAC’s facilitator role.”

One of GAC’s key roles is to coordinate the government’s response to terrorist hostage taking. However, NSICOP found that:

GAC has a three-person team that supports an interdepartmental task force, but in twenty years the Department has done little to prepare for these incidents: there is no policy framework, no training, and no routine tabletop simulation exercises for the task force.

…

At best, GAC convenes implicated departments with much greater operational roles and specific accountabilities, and works to build a coherent approach without authority to direct a whole-of-government response. Part of the challenge is one of the Department’s own making: over the past 10 years, it has not developed the necessary policy, operational and training mechanisms for implicated government organizations to respond to such events coherently. Notwithstanding these gaps, the most significant problem is political: successive governments have failed to provide direction for a framework to address such critical incidents or provide specific direction on individual cases. Together, these challenges undermine the ability of the Department and its security and intelligence partners to respond effectively to hostage-takings.

Upon receiving the review GAC committed to reforms to respond to the issues identified by NSICOP.

Summaries and Recommendations of Prior Reviews

NSICOP’s annual report helpfully provides a listing of past reports that it has undertaken and allocates a page to each review. These summarize the issues taken up in a given report, identify the associated recommendations, and clarify the extent to which the government has (or has not) responded to each of them. The summaries, also, go so far as to indicate when legislation overtook particular recommendations, such as NSICOP’s proposal that the National Security and Intelligence Review Agency (NSIRA) be mandated to issue an annual report pertaining to the Department of National Defence/Canadian Armed Forces activities related to national security or intelligence.

Many of these reviews have drawn significant attention since they were released, such as NSICOP’s report on foreign interference (and which included the recommendation that combatting foreign interference include establishing “regular mechanisms to work with sub-national levels of government and law enforcement organizations, including to provide necessary security clearances”), but the summarization of these reviews is helpful for simply remembering all of the work that the Committee and its members have undertaken since its inception. It would be helpful for all review agencies to develop public timelines to include in their annual reports and on their websites; such timelines could just denote and link to all of the reports the review agency has completed (or begun) so that readers could better appreciate (and remember) their past and ongoing work.

I think that it’s important to highlight that, just one decade ago, these summaries alone would have been considered an amazing amount of detail that pulled the veil back on Canada’s national security activities. That we can read the summaries, as well as the redacted reports that are posted on the Committee’s website, is astounding when considering where Canada was in terms of national security transparency and accountability ten years ago. When combined with other reporting from NSIRA and the Intelligence Commissioner it is apparent that the public and parliamentarians alike are in a remarkably better situation to understand, assess, interrogate, and approve of (or call for the cessation of) the actions carried out by Canada’s national security agencies.

Conclusion

NSICOP has sometimes been on the receiving end of critiques or complaints, some of which have arguably been deserved and others less so. It is a body that has been severely tested by some public and political pressures. And it has been challenged in fulfilling elements of its mandate for reasons described in its 2022 annual report.

Nevertheless, the Committee and its members are to be congratulated for their efforts. They have worked to release information that hitherto has been kept secret from the public and parliamentarians. There remain challenges to overcome and more must be done to further enhance the public’s and parliamentarians’ understanding of national security agencies, challenges and threats facing Canadians institutions and organizations, and responses that the government has undertaken in response. Still, NSICOP has done much to educate the public since its inception and, if its legislation is reformed per its requests, I suspect the Committee could be even better situated to undertaking reviews while further raising the levels of awareness of national security issues.

  1. For my previous analysis of this report, see: “Unpacking NSICOP’s Special Report on the Government of Canada’s Framework and Activities to Defend its Systems and Networks from Cyber Attack” ↩︎

Accountability and the Canadian Government’s Reporting of Computer Vulnerabilities and Exploits

/ Christopher Parsons

Photo by Taskin Ashiq on Unsplash

I have a new draft paper that outlines why the Canadian government should develop, and publish, the guidelines it uses when determining whether to acquire, use, or disclose computer- and computer-system vulnerabilities. At its crux, the paper argues that an accountability system was developed in the 1970s based on the intrusiveness of government wiretaps and that state-used malware is just as, if not more so, intrusive. Government agencies should be held to at least as high a standard, today, as they were forty years ago (and, arguably, an even higher one today than in the past). It’s important to recognize that while the paper argues for a focus on defensive cybersecurity — disclosing vulnerabilities as a default in order to enhance the general security of all Canadians and residents of Canada, as well as to improve the security of all government of Canada institutions — it recognizes that some vulnerabilities may be retained to achieve a limited subset of investigative and intelligence operations. As such, the paper does not rule out the use of malware by state actors but, instead, seeks to restrict the use of such malware while also drawing its use into a publicly visible accountability regime.

I’m very receptive to comments on this paper and will seek to incorporate feedback before sending the paper to an appropriate journal around mid-December.

Abstract:

Computer security vulnerabilities can be exploited by unauthorized parties to affect targeted systems contrary to the preferences their owner or controller. Companies routinely issue patches to remediate the vulnerabilities after learning that the vulnerabilities exist. However, these flaws are sometimes obtained, used, and kept secret by government actors, who assert that revealing vulnerabilities would undermine intelligence, security, or law enforcement operations. This paper argues that a publicly visible accountability regime is needed to control the discovery, purchase, use, and reporting of computer exploits by Canadian government actors for two reasons. First, because when utilized by Canadian state actors the vulnerabilities could be leveraged to deeply intrude into the private lives of citizens, and legislative precedent indicates that such intrusions should be carefully regulated so that the legislature can hold the government to account. Second, because the vulnerabilities underlying any exploits could be discovered or used by a range of hostile operators to subsequently threaten Canadian citizens’ and residents’ of Canada personal security or the integrity of democratic institutions. On these bases, it is of high importance that the government of Canada formally develop, publish, and act according to an accountability regime that would regulate its agencies’ exploitation of computer vulnerabilities.

Download .pdf // SSRN Link

Horizontal Accountability and Signals Intelligence: Lesson Drawing from Annual Electronic Surveillance Reports

/ Christopher Parsons

‘Radome at Hartland Point’ by shirokazan (CC BY 2.0) at https://flic.kr/p/dfn9ei

Adam Molnar and I have a new paper on accountability and signals intelligence, which we will be presenting at the Security Intelligence & Surveillance in the Big Data Age workshop. The workshop will be held at the University of Ottawa later this month as part of the Big Data Surveillance partnership project that is funded by the Social Sciences and Humanities Research Council of Canada.

The paper focuses exclusively on the mechanisms which are needed for civil society actors to evaluate the propriety of actions undertaken by signals intelligence agencies. In it, we argue that Canada’s foreign signals intelligence agency’s public accountability reporting might be enhanced by drawing on lessons from existing statutory electronic surveillance reporting. Focusing exclusively on Canada’s signals intelligence agency, the Communications Security Establishment (CSE), we first outline the relationships between accountability of government agencies to their respective Ministers and Members of Parliament, the role of transparency in enabling governmental accountability to the public, and the link between robust accountability regimes and democratic legitimacy of government action. Next, we feature a contemporary bulk data surveillance practice undertaken by Canada’s signals intelligence agency and the deficiencies in how CSE’s existing review body makes the Establishment’s practices publicly accountable to Parliamentarians and the public alike. We then discuss how proposed changes to CSE oversight and review mechanisms will not clearly rectify the existing public accountability deficits. We conclude by proposing a principle-based framework towards a robust public accountability process that is linked to those underlying domestic and foreign statutory electronic surveillance reports.

A copy of our paper, titled, “Horizontal Accountability and Signals Intelligence: Lesson Drawing from Annual Electronic Surveillance Reports,” is available at the Social Sciences Research Network as well as for download from this website.

More Surveillance Powers Won’t Prevent Intelligence Failures

/ Christopher Parsons

Newspapers B&W (5)I co-authored a comment to the editors of the Globe and Mail, “More Surveillance Powers Won’t Prevent Intelligence Failures,” in response to Christian Leuprecht’s article “Pointing fingers won’t prevent intelligence failures“. Leuprecht asserts that further intelligence sharing is critical to prevent and avoid attacks such as those in Paris, that more trust between intelligence agencies to facilitate international intelligence sharing is needed, and that more resources are needed if particular individuals subject to state suspicion are to be monitored. He also asserted that governments need the powers to act against targeted individuals, and that unnamed ‘critics’ are responsible for the weakening of intelligence agencies and, by extension, for the senseless deaths of innocents that result from agencies’ inabilities to share, monitor, and engage suspicious persons.

The co-authored comment rebuts Leuprecht’s assertions. We point that there is more intelligence collected, now, than ever before. We note that some of the attackers were already known to intelligence and security services. And we note that it was intelligence sharing, itself, that led to the targeting and torture of Maher Arar. In effect, the intelligence community is failing in spite of having the capabilities and powers that Leuprecht calls for; what is missing, if anything, is the ability to transform the intelligence collected today into something that is actionable.

The full comment, first published at the Globe and Mail, is reproduced below:

More Surveillance Powers Won’t Prevent Intelligence Failures
Re: “Pointing Fingers Won’t Prevent Intelligence Failures” (Nov 25):

The horrific attacks in Paris have led to a wave of finger-pointing – often powerfully disassociated from the realities of the failures (Pointing Fingers Won’t Prevent Intelligence Failures – Nov 25). The answer from security agencies is inevitably to request more surveillance and more capacity to intrude into citizens’ lives.

These requests are made despite the historically unprecedented access to digital information that security agencies already enjoy and repeated expansions of security powers. Clearly “more security” is not the answer to preventing all future attacks.

The intelligence failure in Paris painted a familiar picture. Many of the attackers were known to French officials, and Turkish intelligence agencies sent repeated warnings of another. Yet in their rush to blame communications technologies such as iPhone encryption and the PlayStation (claims since discredited), security agencies neglect the lack of adequate human intelligence resources and capacities needed to translate this digital knowledge into threat prevention. Also absent is attention to agency accountability – the unaddressed information-sharing problems that caused the mistaken targeting and torture of Maher Arar.

The targets of terror are not only physical, but also ideological. Introducing a laundry list of new powers in response to every incident without regard to the underlying causes will not prevent all attacks, but will leave our democracy in tatters.

Vincent Gogolek, Executive Director, BC Freedom of Information and Privacy Association (BCFIPA)

Tamir Israel, Staff Lawyer, Canadian Internet Policy & Public Interest Clinic (CIPPIC), University of Ottawa

Monia Mazigh, National Coordinator, International Civil Liberties Monitoring Group (ICLMG)

Christopher Parsons, Postdoctoral Fellow, Citizen Lab at Munk School of Global Affairs, University of Toronto

Sukanya Pillay, Executive Director & General Counsel, Canadian Civil Liberties Association (CCLA)

Laura Tribe, Digital Rights Specialist, OpenMedia

Micheal Vonn, Policy Director, British Columbia Civil Liberties Association (BCCLA)

Photo credit: Newspapers B&W (5) by Jon S (CC BY 2.0) https://flic.kr/p/ayGkBN

Canadian Police Requests for Telecommunications Data

/ Christopher Parsons

2498847226_9beb1f55db_o-300x200In our report, “The Governance of Telecommunications Surveillance: How Opaque and Unaccountable Practices and Policies Threaten Canadians,” we discussed the regularity at which government agencies gain access to telecommunications data. Save for the Canadian Border Services Agency, federal government agencies that are principally responsible for conducting domestic telecommunications surveillance, such as the Royal Canadian Mounted Police, could not account for how often they use their surveillance powers.

In the course of investigating government access to telecommunications data we also contacted regional policing departments. This post expands on findings we provided in our report to discuss, in depth, the data provided by responsive police departments. We conclude by asserting that new legislation must be introduced and passed so that Canadians become aware of the magnitude of contemporary telecommunications surveillance that policing organizations are involved in on a yearly basis.

Requests to Police Departments

We filed requests to Canadian police departments to determine how often individual departments were exercising telecommunications surveillance powers. Though our report principally focused on federal government agencies’ surveillance, we had hoped to effectively juxtapose provincial/municipal telecommunications surveillance against their federal brethren. We ultimately decided to not conduct a detailed juxtaposition in the report because an insufficient number of police departments responded to our legally-binding requests for access to government data in time for publication.

We filed requests for information to police departments operating in Nova Scotia, Ontario, Alberta, and British Columbia. These requests identified the provincial statutes we were relying on to request information. We paid fees to the various police departments to initiate the processing of the requests. The only two police departments that were responsive to our requests were the Halifax and Vancouver police departments. The most notable non-responsive departments police the cities of Calgary and Toronto.

Continue reading →

Does Mexico’s Transparency Report Promote Accountability?

/ Christopher Parsons

7666659340_d3096c746a_k-199x300Red en Defensa de los Derechos Digitales (R3D) has released a report that compares Mexican ISPs’ transparency and privacy practices. The work parallels the Karisma Foundation’s report about Columbian ISPs’ transparency and privacy practices; both the Mexican and Columbian organizations’ reports are based on the Electronic Frontier Foundation’s “Who Has Your Back” reporting format. The format is designed to visually summarize the practices taken by Internet companies so that end-users can easily evaluate how companies protect their users.

This post briefly summarizes R3D’s findings and then proceeds to discuss whether Mexican companies’ transparency report genuinely enable corporate accountability. Based on academic literatures, a strong argument can be made that the aggregated Mexican transparency report that have been issued by the Mexican telecommunications companies does not make the companies particularly accountable to their customers. The post concludes by raising questions about the status of third-party comparisons of corporate privacy and transparency practices: why are intermediaries like R3D, Karisma Foundation, Electronic Frontier Foundation, or IX Maps so important? And what are the deficits of contemporary comparisons of corporate transparency and privacy practices?

Summary of R3D Findings

RD3’s report examines privacy policies and codes of practices from the eight Mexican telecommunications companies that, in aggregate, compose 98% of Mexico’s mobile, fixed line, and broadband markets. Out of a possible six ‘stars’ only one company (Movistar) received two stars (the most of any company); half for requiring a warrant for data requests, half for publishing a transparency report, and a full star for advocating for privacy. The worst company, Megacable, received just a half-star for requiring a warrant for data requests.

Companies could receive either a full star, half-star, quarter-star or no star in each of the categories that are noted in Figure One. The evaluation criteria for receiving these grades follows the figure.

BAC1841D-E5B7-472F-9FB7-1544E3C3D550-1024x554

Continue reading →