CSIS lacked proper policies, procedures to manage new secret technology: spy watchdog

Hey there, time traveller!
This article was published 14/10/2025 (358 days ago), so information in it may no longer be current.

OTTAWA – The Canadian Security Intelligence Service lacked “adequate policies and procedures” to manage a confidential technology for collecting information, says a newly released spy watchdog report.

The National Security and Intelligence Review Agency says CSIS mischaracterized a novel technical capability as an extension of existing know-how.

CSIS also did not consult Public Safety Canada about its plans to acquire this novel technical capability and did not notify the public safety minister or the Federal Court before using it in an operation, the spy watchdog says.

“Further, CSIS used this technology prior to satisfying all regulatory requirements,” the report says.

The review agency also found CSIS kept collected information without clearly spelling out its authority for retaining it. 

The Canadian Press obtained a heavily redacted version of the intelligence review agency’s top secret report through the Access to Information Act.

The descriptions of both the novel technology in question and the way CSIS used it have been censored from the report.

The review agency reported that the technology introduced “a significant expansion of collection capabilities and operational risks.”

CSIS had no immediate comment on the watchdog report.

In applying for a court warrant to use techniques that would otherwise be against the law, CSIS and Justice Department counsel are bound by a duty of candour, which entails providing adequate context and information about new technologies, the review agency says.

The watchdog notes that when a CSIS team wants to develop or acquire a new technology, it is now required to present its proposal to the spy service’s recently established Operational Technology Review Committee.

The committee’s role is to identify and assess potential risks related to the procurement, development, testing and use of the new technology.

The committee may recommend that CSIS notify the minister and present the technology to the Federal Court to inform its decision on warrant applications.

The review agency says that while the committee appears poised to address some of the issues of concern, it is less clear that the “broader cultural changes” required to realize the committee’s potential are underway.

Until CSIS’s organizational culture shifts from a narrow focus on data collection — under a warrant or otherwise — to sound stewardship of data at every step, the spy service will continue to be at risk of non-compliance with the law and ministerial direction, the report concludes.

The review agency makes several recommendations to improve policies and procedures relevant to use of the novel technology.

It urges CSIS to ensure risk assessments conducted throughout the life cycle of new technologies and techniques are rigorous, documented and comprehensive in scope.

It also says CSIS should invest in technical processes and systems that can assess, accept, label, use and destroy data in compliance with legal obligations.

This report by The Canadian Press was first published Oct. 14, 2025.