CSIS risks privacy of innocent people despite scathing court ruling: watchdog

CSIS processed the metadata beginning in 2006 through its Operational Data Analysis Centre to produce intelligence that can disclose intimate details about individuals.

Metadata is information associated with a communication, such as a telephone number or email address, but not the message itself.

The intelligence review committee report, tabled in Parliament, noted that CSIS has since destroyed most of the metadata in question.

But it found the spy service was “still dealing with the implications” of the court decision when it comes to handling information about third parties.

The committee found that CSIS’s definitions, guidelines and training related to assessment and reporting of third-party data were “clearly insufficient.”

“In addition, (the review committee) is concerned with respect to CSIS’s capacity to deliver policy development commitments.”

The committee looked at one dataset assembled largely from third-party communications collected under warrant that was initially retained in 2008. In November 2016, after the court decision, CSIS approved keeping it a second time, but without proper review, the committee report says.

The dataset did not meet the proper threshold under the CSIS Act and was therefore kept “unlawfully,” the report adds.

In a statement Wednesday, Public Safety Minister Ralph Goodale said he takes the matter “very seriously,” and a full review of such cases is underway.

The committee also looked at how the spy service was handling bulk datasets — electronic information collected in large batches that may include information about security threats among other, more mundane records.

The committee “saw no evidence” that CSIS had changed its policies and procedures concerning the collection of bulk datasets following the 2016 court decision, creating a risk the spy service could again stray beyond the law.

The findings come as a Liberal national security bill, currently before Parliament, proposes new authorities for CSIS to crunch and analyze data.

The committee report says the powers would “require rigorous governance, procedures and training to be in place from the beginning,” given its findings on how CSIS handles data.

It recommends the spy service come up with a “robust process” for assessing the privacy and legal risks to Canadians associated with datasets.

In a response included in the report, CSIS says the dataset framework in the Liberal legislation effectively addresses those concerns. “New processes, systems and policies are being developed to ensure CSIS is prepared to implement the bill.”

A modern intelligence agency requires the lawful authority to collect and analyse a broad range of data to detect threats and identify previously unknown trends and patterns, CSIS director David Vigneault said in a statement.

“Datasets are important building blocks that could lead not only to initiating an investigation, but to unfolding investigations.”

However, Vigneault acknowledged CSIS must do a better job of demonstrating the usefulness of data analysis.

— Follow @JimBronskill on Twitter

Jim Bronskill, The Canadian Press

by Canadian Press

CSIS risks privacy of innocent people despite scathing court ruling: watchdog

What's Trending