How Canada’s shadowy metadata-gathering program went awry | Hacker News Reader

How Canada’s shadowy metadata-gathering program went awry

theglobeandmail.com

Turns out we are collecting metadata too! You might be wondering what all these acronyms mean. Rough approximation:

  CSEC (see-sec) = NSA
  CSIS (see-sis) = CIA
  RCMP (R-C-M-P) = FBI/DEA/ATF/Secret Service/Regular Police

  (RCMP are federal semi-paramilitary force that 
   can move across provinces, they also serve as
   a police force in remote regions.)

For folks in the states, we usually know the RCMP down here as "Mounties"

http://upload.wikimedia.org/wikipedia/commons/d/dc/Mountie_i...

Yeah, that is their formal wear. Here is what they look like out on the road.

http://www.youtube.com/watch?v=7KTnLVzI2q4

Another first-order approximation is: the RCMP do "local policing" where there is no local police force.

So in Ontario, where there is a provincial police (OPP) the RCMP don't do nearly as much as they would in, say, BC, where there is no provincial police force. (I don't think I've ever seen an RCMP car in Ontario outside of Ottawa).

The criminal justice system (including police and the courts) is a provincial responsibility in Canada. The only federal piece is the Supreme Court of Canada. Jurisdictions that have no provincial police force (all of them except Ontario and Quebec) contract the RCMP to do their policing but technically could contract it to anyone they want. Arrest warrants are not generally valid outside the province they're issued in (although Canada-wide warrants can be issued in extraordinary circumstances). Municipal police forces receive their authority from the province that they're in. So in theory, the Alberta government (for example), could hire the Montana Highway Patrol to be their police force if they so desired.

In short, every jurisdiction in Canada has one and only one agency responsible for enforcing the Criminal Code, and that may be a municipal police force, a provincial force, or the RCMP contracted by a province, depending on where you are. So unlike the USA, the RCMP is not like the FBI in that it does not have any additional powers to any other police agency, just a different jurisdiction.

I think "acrimonious" was likely supposed to read "acronyms".

Yes, yes it was! Updated!

CSIS isn't really like the CIA at all. It's a civilian agency responsible for intelligence gathering and sharing that information with the RCMP to make arrests. Their officers do not carry weapons (only police and RCMP have that right) and their oversight is done by the SIRC (Security Intelligence Review Committee). This model is quite different from the CIA. So while it may sound cool to compare them to the CIA, they're not like them at all.

That sounds just like CIA actually. Civilian agency, responsible for intelligence gathering and sharing that information with <others> to <do things>. They're not law-enforcement focused, which might be the key difference you're focusing on?

Yes. Additionally, the CIA has historically been able to perform their own para-military operations which is clearly outside of the scope (and budget) of CSIS.

I have to admit, I did not expect this surveillance scandal story to have the legs it's shown, and I didn't expect it to "go international". This makes me very happy, to see that people in other countries are starting to get involved and ask questions about their own governments as well. This needs to stay in the public eye and it needs to stay there until changes are made.

I think the US greatly helped that with their constant reassurances that "only foreigners are being spied on in this manner". Worst line to use in such a globalised world!

The "Five Eyes" agreement has had a big impact in the other countries (United Kingdom, Canada, Australia, and New Zealand.)

In NZ the PM has kept quiet basically and it's blowing up in his face. And may it get worse.

Didn't the PRISM stuff all have NOFORN though, rather than REL FVEY?

If Canada, hypothetically, has the capability to collect all US Citizen's data, then exchange the analysis with NSA, does this make NSA 'spying on Americans' legal or constitutional?

Hasn't this been the "norm" with the GHCQ in the UK.

Meh, just gather it directly then say oopy when caught. See Dotcom, New Zealand.

Thank you for your email regarding the Communications Security Establishment Canada (CSEC).

CSEC operates within all Canadian laws, including the Privacy Act, the Canadian Charter of Rights and Freedoms, and the Criminal Code. CSEC is prohibited by law from directing its foreign intelligence activities at Canadians anywhere in the world or at any person in Canada. In addition, there are rigorous procedures in place to ensure that it adheres to this prohibition.

The Ministerial Directive on Metadata clearly defines metadata and specifies that CSEC may only collect and use metadata in support of its foreign intelligence and cyber-protection mandate. For intelligence purposes, CSEC uses metadata to isolate and identify foreign communications and foreign targets. The Ministerial Directive also outlines strict conditions to protect the privacy of Canadians. Under the National Defence Act, CSEC is mandated to provide technical and operational assistance to law enforcement and security agencies in the performance of their lawful duties.

All CSEC and law enforcement and security agencies’ activities are strictly bound by the limits of their lawful duties, including court warrants. Under such circumstances, CSEC activities are subject to review by an independent CSE Commissioner who is responsible for reviewing CSEC activities to ensure that all CSEC activities comply with the law and protect the privacy of Canadians. All information acquired under the warrant belongs to the assisted agency.

CSEC does not target the communications of Canadians anywhere and has legislative measures in place to protect the privacy of Canadians. As the CSE Commissioner noted in his 2011-2012 report, the focus of CSEC activity is foreign intelligence. In this report, the CSE Commissioner highlights that all reviewed CSEC activities were authorized and carried out in accordance with the law. The Commissioner also highlights CSEC’s culture of lawful compliance and for protecting the privacy of Canadians.

Darn, I'd always kind of hoped we in Canada weren't so surveillance crazy too.

If so, then the other problem is bringing attention to it. If something like Edward Snowden happens in the US, it gets a lot of attention and world-wide recognition. If it happens in Canada, only we know about it and it's likely to slip from our news rather quickly (or so it would seem).

Given the financial resources of CSEC, DND, and Canada vs. the NSA, I very much doubt we are so "surveillance crazy" as you may suggest. While I agree that we definitely should be worried about the potential for abuse by CSEC and the potential lack of oversight by the Canadian government, I'm personally more worried about the fact that the Americans have access to our data and that we, as Canadians, have no right to privacy to our own data as non-Americans.

For instance, if you look at www.ixmaps.ca, you can see that traceroutes of URLs destined for Canadian addresses from within Canada are still routed through the United States. Which potentially means that our own traffic is being monitored by the NSA since they are routed and bounced through the US before returning back into the country. I find this notion rather appalling that visiting a Canadian government website would require a request to an American server instead of going directly to the Canadian destination.

This level of intrusion into the Canadian system is more shocking and should be looked as opposed to trying to think our own government system is somehow a parallel of what the Americans are doing.

TLDR; I'm more worried about Americans (i.e. the NSA) invading our privacy where we have no rights, as opposed to a Canadian agency violating them when we have courts to fight for our rights. Yes, it would be horrible if the government/justice system was in bed with CSEC, but if the Americans are ultimately in control of our system, I'm very much more afraid of that than our own government.

I agree that the probability of Canadian communication getting swept up in the NSA net is high, but I don't think I can agree with your portrayal of the government of Canada's interest in surveillance as low.

First, the article says: "And where Washington has demonstrated its commitment to the NSA with the construction in Utah of an immense $2-billion base said to be capable of processing a zettabyte of data, the Canadian government is building CSEC a gleaming new $900-million, 72,000-square-metre compound in Ottawa" - that's $900 million/35 million citizens, or more than $25 per person. The US figure is $2 billion/319 million, or approximately $6 per person. That's 4 times the money per capita at the current exchange rate.

Second, just months before the PRISM controversy the US government began considering requiring interception capabilities for service providers ( https://www.eff.org/deeplinks/2013/05/caleatwo ), among other requirements... Sadly, Canada beat them to the punch. We (our government) tried to push something similar a year ago (called C-30, which caused quite an uproar) and our government still wants to bypass warrants to snoop with a bill called C-50.

Indeed, you can get a general idea of the relative budgets of the CSEC vs. the NSA by comparing their headquarter buildings:

CSEC: http://upload.wikimedia.org/wikipedia/commons/e/e4/Tilley_Bu... NSA: http://upload.wikimedia.org/wikipedia/commons/8/84/National_...

Indeed, the CSEC building actually looks much better in that picture than in real life. I see it every day because it's on my commute, and it's actually quite run-down. Mind you, as you said, you can do a lot of damage even with a small amount of money. I also completely agree that Canadians should be deeply concerned about how much of our communications fall under American jurisdiction simply because of the architecture and governance of the Internet.

The NSA is well within its rights, without warrants of any kind and without consulting any Canadian authorities, to intercept virtually all Internet traffic that Canadians produce. Most of it either goes to the States (because most major sites are hosted there), or goes through the States on its way to somewhere else in the world (even elsewhere in Canada).

Reply on news.ycombinator.com