CSE: What do we know about Canada's eavesdropping agency?

Recent revelations about the extent of surveillance by the National Security Agency in the U.S. have sparked interest in the activities of Canada's own highly secretive agency.

The Communications Security Establishment (CSE) is the lesser known of Canada's two spy agencies and focuses on electronic surveillance.

• Should Canadians worry about data snooping?

Here’s a closer look at CSE and what it does.

What is it?

CSE describes itself as "Canada's national cryptologic agency." Simply put, it encodes and decodes secretive computerized messages. In today's cyber-focused world, that means sifting through online activity to hunt down and prevent potential attacks.

The electronic surveillance service has three mandates. It's expected to gather foreign signals intelligence, known among the spies as SIGINT, which specifically refers to monitoring online activity abroad.

But it has also been given the task of protecting the government here at home from hackers and state-sponsored attacks on its computer systems. That gives the agency a dual mandate: offensive and defensive.

Thirdly, the spy agency is expected to lend its technical expertise to law enforcement and security agencies such as the RCMP and CSIS, Canada's primary security agency.

'It’s a reasonable question to ask on what basis we can be confident they are keeping in the law when there’s such technical capability of them sharing information.' — Andrew Clement, University of Toronto

When was it established?

The decades-old agency first took root in 1941 during the Second World War. 

At the time, the small team of cryptographers called the Examination Unit operated out of a house in Ottawa, trying to intercept and analyze war communications. It was then part of the National Research Council (NRC). 

Five years later, it became the Communications Branch of NRC. Though WWII was over, authorities in both the U.S. and Canada decided that signals intelligence was still highly valuable in that Cold War period.

Canada's most secretive agency, this unit only came to the public's attention nearly two decades later when, in 1974, CBC TV aired a documentary on it titled The Fifth Estate: The Espionage Establishment.

After that, the rapidly expanding unit was renamed the Communications Security Establishment and placed in the National Defence portfolio.

The agency swelled further after the Sept. 11, 2001 attacks in the U.S., with a doubling of its personnel and a broader mandate.

Passed in late 2001, the Anti-terrorism Act gave CSE expanded use of electronic surveillance. Under the new law, it could intercept foreign communications that begin or end domestically as long as one party is outside Canada.

How big is it?

The organization employs approximately 2,000 people. In 2013-2014, its budget was estimated at $460 million. 

A new $880-million headquarters is under construction in Ottawa to house the ever-expanding workforce. The 72,000-square-metre compound is located in the eastern part of Ottawa and is scheduled to open in 2015.

How does CSE differ from CSIS?

Both spy agencies monitor security threats against Canada, but there are crucial differences in focus and how they operate.

The better-known Canadian Security Intelligence Service (CSIS) grew out of the old RCMP Security Service and looks for threats inside Canada. CSE primarily examines threats outside the country.

As well, CSIS uses human intelligence, meaning spies and informers in its work, while CSE relies almost entirely on technology to monitor threats from abroad. 

Does CSE share information with other countries?

CSE shares information with intelligence agencies in the so-called "Five Eyes" group of countries — namely the U.S., U.K., Australia, New Zealand and Canada.

What is CSE monitoring exactly?

The full extent of CSE’s monitoring activities is not known, but it primarily collects foreign communications.

Questions have arisen over whether it collects what's called electronic metadata — essentially the data about the electronic transmission — because it can provide significant details about an individual. Online metadata can include cellphone numbers, length and time of calls, email addresses and internet routing information.

CSE is legally allowed to use metadata, but only, the act suggests, in a global context or to protect the government's computer systems. 

Is CSE spying on Canadians?

CSE says it does not intentionally target the private communications of Canadians or any person in Canada. It's constrained by the National Defence Act. 

But ministerial authorizations also give the agency special permissions, and those can include allowing it to intercept Canadian communications under certain conditions. 

However, CSE is also part of the "Five Eyes" group of countries with whom it has shared intelligence for decades, observes Andrew Clement, a professor in the Faculty of Information at the University of Toronto.

While each of these intelligence agencies assures its citizens that it is only focused on foreign communications, Clement says that it stands to reason that in sharing information with its intelligence partners CSE could be gaining intelligence on Canadians.

CSE "will never confirm or deny this," Clement says, "but there’s a very strong suggestion [that they do], and in the face of these revelations, it’s a reasonable question to ask on what basis we can be confident they are keeping to the law when there’s such technical capability for them sharing information."

David Skillicorn, a professor in the School of Computing at Queen’s University, says this sharing is one aspect of the data collecting relationship "that has always been carefully constructed."

"The Americans will not use Canadians to collect data on U.S. persons, nor will any of the other Five Eyes countries," Skillicorn says.

"In fact, in practice, it’s as if the five countries’ citizens were one large, collective group, and their mutual communications are not intercepted by any in the Five Eyes community."

Still, Clement says he believes there are extenuating circumstances when CSE actually eavesdrops on the content of specific communications when a person is "of interest."

What kind of oversight is there for CSE?

There's no day-to-day oversight of CSE, but there is an independent body — the CSE Commissioner's Office — set up to review its past activities each year. A retired judge serves in the part-time position of CSE commissioner and has a small office of employees to help him conduct reviews.

The commissioner must submit regular reports to the minister and an annual report to Parliament. The goal of the review agency is to ensure it is complying with the law. Though the office has issued a number of recommendations, it has never found CSE to be acting unlawfully.

"Certainly there is a governance and a structure in place above CSE and the other bits of the intelligence organizations," says Skillicorn.

"But I think every Western country has had the experience of some quote-unquote scandal, which has resulted in [the forming of] a commission of some sort and the imposition of a new regulatory framework. And that suggests that things are never quite as clean as people would like them to be."