Canada’s main surveillance agency – Canadian Security Intelligence Service (CSIS) – has been illegally accessing Canadian citizens’ metadata for over a decade. That was the conclusion of a Federal Court case last Thursday. The secret metadata collection program was run by The Operational Data Analysis Centre (ODAC). The secret snooping regime was completely unknown to the Canadian public until last week’s ruling. From the ruling:
“The end product [of ODAC surveillance] is intelligence which reveals specific, intimate details on the life and environment of the persons the CSIS investigates. The program is capable of drawing links between various sources and enormous amounts of data that no human being would be capable of.”
The ruling is almost identical to a recent ruling in the UK by the Investigatory Powers Tribunal. It found that UK intelligence at the Government Communications Headquarters (GCHQ) had been illegally snooping for 17 years. The repercussions of the Snowden revelations are still unfolding, three years down the line.
Sadly, that Metadata collection is being made legal in the UK by the new ‘Snooper’s Charter.’ It will force UK ISPs to retain metadata for a year. In Canada, a person’s metadata may already be accessed with a warrant. With revelations that CSIS was accessing metadata illegally, Canada will likely push for its own Snooper’s Charter-style law.
The Federal Court decided that CSIS was acting wrongly because it collected the third-party metadata of many innocent people.
“The evolution of technology is no excuse to flout or stretch legal parameters. When the information collected does not fall within the legal parameters delimiting the agency’s functions and actions, it cannot legally be retained,” the court said.
After the ruling, CSIS director Michel Coulombe ordered that all retention of metadata be immediately suspended,
“[CSIS] has halted all access to analysis of associated data while we undertake a thorough review of the system.”
Data Collection is Legal
This is where the story gets more disturbing. For now, data retention of third parties by CSIS (not requested with a warrant) is no longer permissible. According to Coulombe, however, the collection of metadata is still legal. One has to wonder, then, what the Canadian definition of collected (as opposed to retained) actually is. Once collected, how long is it kept before it becomes ‘retained?’
Getting an answer to that question isn’t easy. Most Canadian ISPs have chosen to interpret Canada’s Personal Information Protection and Electronic Documents Act (PIPEDA) to mean that they are law-bound not to disclose whether they have shared data with law enforcement. Despite attempts by Christopher Parsons (privacy expert and researcher at the Munk School of Global Affairs), no-one really knows.
The Federal Court’s ruling proves that metadata was retained until last Thursday. In addition, Coulombe’s statement that collection is legal seems to imply that Canadian ISPs will continue to collect metadata. How long that data is kept once collected is a gray area.
One hopes that, from now on, CSIS will not access third party metadata without a warrant. The likelihood, however, is that the Canadian authorities will simply ask for more warrants in order to carry on snooping.
Parsons’ inability to find out what ISPs are retaining infuriates him. Following his attempts to get the information from ISPs he commented,
‘Retention schedules matter. How long you store data should not be a corporate secret, because it’s about citizens. Here we’re talking about basic, basic, basic privacy information. How long do you store information about me? None of these companies aside from TekSavvy have tried to comprehensively respond to that question.’
We know that Canadian citizens have been suffering from huge amounts of surveillance. This will very likely continue legally in one form or another. With that in mind, using encryption services such as VPNs to protect web browsing and internet communication data is important for any Canadian resident who cares about digital privacy.