Red flags raised over new powers for cyber-spies

Under Bill C-59, CSE would have ability to launch cyberattacks with little ‘meaningful’ oversight, researchers warn

OTTAWA— Canada’s electronic spies will be limited “only by their imagination” in coming up with new cyberattacks and espionage campaigns under proposed legislation, a new report warns.

The Communications Security Establishment will be able to select targets and launch cyberattacks with little “meaningful” oversight, according to an analysis of Bill C-59 by the University of Toronto’s CitizenLab.

Bill C-59 “affords the CSE the ability to engage in a vast range of unenumerated and deeply problematic activities with the potential to seriously interfere with charter-protected rights and freedoms,” reads the report, to be made public Monday.

Bill C-59 proposes to give CSE — for the first time in the agency’s postwar history — the explicit power to conduct cyber- attacks and sabotage against foreign states and people. Until now, the secretive agency has been limited to intelligence gathering, defending government networks and assisting law enforcement.

The proposed powers are broad. The bill explicitly prohibits CSE from causing death or bodily harm, and from obstructing or perverting “justice or democracy.”

That leaves a very long list of permitted activities, the researchers note.

“From mass dissemination of false information, to impersonation, leaking foreign documents in order to influence political and legal outcomes, disabling account or network access, large-scale denial of service attacks, and interference with the electricity grid, the possibilities for the types of activities contemplated in (Bill C-59) are limited only by the imagination,” the report reads.

Under the legislation, the CSE would require sign-off from both the minister of national defence and the minister of foreign affairs to launch a cyberattack. But the offensive cyber-operations would not require judicial sign-off or oversight, nor would they require approval by the proposed independent intelligence commissioner, the report reads.

In a statement Friday, CSE spokesperson Ryan Foreman suggested a warrant system for cyber-operations may not be the best fit for the agency’s mandate.

“CSE is a foreign intelligence and cyber security organization, not a domestic security or law enforcement agency. Warrants for law enforcement . . . are generally for specific targets or operations . . . whereas CSE’s ministerial authorizations authorize a class of activities,” Foreman wrote, noting that the CSE is prohibited from directly targeting Canadians or people in Canada.

“However, these and all of CSE’s activities would be subject to review” by a new parliamentary committee.

The report was prepared by CitizenLab researchers Christopher Parsons, Lex Gill and Ronald Deibert, as well as Tamir Israel, a lawyer with the Canadian Internet Policy and Public Interest Clinic, and Bill Robinson, who has long chronicled CSE’s history and activities.

In an interview with the Star on Sunday, Gill said Canada also runs the risk of normalizing state-sponsored hacking and disinformation campaigns — a particular worry in North America, as the United States continues to unravel alleged Russian attempts to influence the 2016 presidential election through disinformation and hacking.

“The open question (is) whether or not affording the (CSE) these types of capabilities will contribute to Canada’s security interests or undermine them,” Gill said.

“By creating a climate which normalizes these types of activities, creates a legislative framework for them, we’re accepting as Canadians that we think that these types of operations are okay. I’m not convinced that Canadians have had a robust public conversation about . . . a kind of cyber warfare.”

The report compares CSE’s new cyber operations powers to the much-criticized “disruption” powers granted to another security agency, CSIS, by the Conservatives in 2015. Like the Conservatives’ Bill C-51, the Liberals’ national security bill permits CSE to take a wide array of “disruptive” activities — while explicitly prohibiting only a few limit cases.

Bill C-59 is still before the House of Commons’ national security committee. The governing Liberals have signalled a willingness to substantially amend the legislation should issues be raised. The committee’s review will resume in early 2018.