The Canadian Press - ONLINE EDITION
Electronic spy agency gathers personal information in cyberdefence role
OTTAWA - Canada's electronic spy agency says it gathers and sometimes keeps personal information — including names and email addresses of Canadians — as part of efforts to protect vital networks from cyberattacks.
Communications Security Establishment Canada maintains an information bank containing the personal information of "potentially any individual" who communicates electronically with a key federal computer network while CSEC is assessing its vulnerability.
Information in the bank — known as CSEC PPU 007 — is held for up to 30 years before being transferred to Library and Archives Canada, says a description in the federal Info Source guide, which lists the various categories of personal information held by the government.
"Personal information may be used to assess potential threats to information technology systems subject to the assessment, and to help ensure the security of these electronic systems," the notice says.
The listing sheds light on a little-known aspect of CSEC's work — threat assessments and technical analyses aimed at strengthening federal defences against foreign cyberattacks on government computers.
The Ottawa-based spy agency has come under intense scrutiny in recent months due to leaks by a former contractor for the National Security Agency, CSEC's American counterpart and close working ally.
CSEC insists it targets only foreign communications — from email to satellite traffic — of intelligence interest to Canada. However, the spy service acknowledges it cannot monitor global communications in the modern era without sweeping up at least some Canadian information.
As a result, CSEC's cyberdefence activities are permitted through special authorization of the federal defence minister. Otherwise, they would risk contravening the Criminal Code provision against intercepting the private communications of Canadians.
Records recently obtained under the Access to Information Act say CSEC planned to focus its cyberdefence operations in 2012-13 on its own computer networks and those of three other federal institutions: National Defence, Foreign Affairs and Shared Services Canada, which administers the federal secure communication channel, known as SC Net.
The Info Source listing says personal information collected by CSEC during cyberdefence efforts may include a person's full name, email address, Internet Protocol (IP) address and any incidental personal details contained in electronic routing codes, or metadata.
Information from the databank may be shared with domestic police agencies "or foreign bodies" in keeping with formal agreements, the listing says.
The foreign bodies are surely CSEC's Five Eyes partners — the U.S. NSA and similar agencies in Britain, Australia and New Zealand, said Wesley Wark, a visiting professor at the University of Ottawa's graduate school of public and international affairs.
Wark called it "remarkable" that information can be held for 30 years.
"What this material does not tell us, of course, is the extent of the personal information held as a result of cybersecurity activities," he noted.
The notes released under Access to Information say that if CSEC intercepts a private Canadian communication under ministerial authorization, "it can only be used or retained if it is deemed essential to international affairs, defence or security."
Information collected during an assessment of a federal agency's computer systems — including personal data — is destroyed once the test is complete, or sooner if it is not needed to "identify, isolate or prevent harm" to the network, said CSEC spokesman Ryan Foreman.
In some cases, Foreman indicated, the personal information of a Canadian may be kept if a foreign cyberattacker engages in phishing — an attempt to compromise a government department's system by sending a carefully crafted email that appears to originate from a known or trusted sender.
In other cases, a known piece of malware might be retained and used to prevent future cyberattacks, he said.
Asked Wednesday if Canadians have anything to fear, Defence Minister Rob Nicholson said CSEC works well.
"There's an independent commissioner who reports every year and has found CSEC is compliant with Canadian law and privacy laws," he said.
Speaking to a group of senators Wednesday, Wark characterized the commissioner's annual reports as insider exercises that tell Canadians little.
He challenged senators to read one of the reports and "make any sense of it."
— With files from Murray Brewster
Follow @JimBronskill on Twitter
Have you found an error, or know of something we’ve missed in one of our stories?
Please use the form below and let us know.
Having problems with the form?Contact Us Directly
(1 of 41 articles for today)7:29 PM 0
WHISTLER, B.C. - The Arctic may be a hot commodity, with remarkable resource and tourism opportunities, but a conference has ...
Photo Store Gallery
- RCMP in New Brunswick completes investigation in python deaths, now with Crown
- Edmonton drug dealers handing out cocaine samples to potential customers
- Survivor of plane crash, family of dead passenger still seeking damages from airline
- Can you keep a secret? Edmonton couple reveals $50M lotto win after 7 months
- Protesters denounce Israeli offensive in Gaza, call on Harper to support peace
- Death of a Quebec mayor from insect stings underscores need to be prepared
- Canada's border agency had thousands of outdated lookout flags in system
- List of charities undergoing tax audits related to political activities
- Fruit from California recalled due to possible Listeria contamination
- Suspect in Calgary stabbings sent to mental hospital for assessment
- RCMP charge Sen. Mike Duffy with fraud, breach of trust and bribery
- Ontario medical student, girlfriend among passengers of doomed Malaysian flight
- Conservative party president's 7-year-old daughter hit by minivan, killed
- Mayor of Montreal-area community dies after being stung by wasps
- Police investigate suspicious death at Pemberton, B.C. Music Festival
- Canadian teacher detained in Jakarta jail on accusations of child sexual assault
- Duffy accused of charging for personal trainer, makeup artist, funeral travel
- Big Lake Ontario shark hoax shows risks posed by viral marketing, experts say
- New report questions Canadian Ukraine election monitoring missions
- Cdns at odds with Harper gov't priorities: Finance Canada focus-group report
- Family of missing boy, grandparents won't give up on finding them alive
- Moms change diapers, Dads form leaders: Justice minister's emails to staff
- Calgary police confirm violent incident in case of missing boy, grandparents
- $20,000 per person:Activists push for guaranteed minimum income for Canadians
- 'We're lucky to have her in our lives;' baby survives crash that killed mother
- Suspect in case of missing grandparents and child to make court appearance
- Investigators bring in boat in search near Calgary-area acreage in missing family case
- Calgary police say there are other leads in case of missing boy, grandparents
- Ex-wife of B.C. homicide victim says man conned her; both appeared on Dr. Phil
- Police say search near Airdrie part of probe into missing Calgary residents
Ads by Google