C-59 could hurt security, allow surveillance on telecom networks: report

A comprehensive new report from the University of Toronto’s Citizen Lab and the the University of Ottawa’s Canadian Internet Policy & Public Interest Clinic (CIPPIC) has identified dozens of potential issues with Bill C-59, including elements that could “have the net effect of undermining security in Canadian networks, rather than enhancing it.” The legislation could also allow the interception of all private communications on a telecom’s network with one authorization, the report said, a potential scenario it called “deeply troubling.” The bill, which was introduced by the federal government this summer, aims to create a national security and intelligence review agency, establish an independent intelligence commissioner position, further empower the Communications Security Establishment (CSE) and facilitate sharing of information within the government. A parliamentary committee reviewing the bill heard in recent weeks that, among other issues experts have flagged, the way the bill is written leaves some Canadians’ constitutionally-protected data open to collection without independent judicial authorization, and that it could weaken encryption tools. One of the many areas the report from Citizen Lab and CIPPIC covered was the effect the legislation would have on telecoms’ networks. For instance, powers included in Bill C-59 allow the government to designate non-governmental electronic information or infrastructure as critical, it said, noting that designation is likely to apply to the telecom sector. Doing so would bring it “within the cybersecurity aspect of the CSE’s mandate,” it said. “This is an exceptional departure from the CSE’s current legal framework, as it explicitly grants the CSE permission to operate on private Canadian systems and infrastructure potentially implicating a large number of private sector actors,” the report added, though it noted that can only happen following the written request from the infrastructure owner or operator. However, it said, the ministerial authorizations don’t have to be issued on a “per threat” basis, and that means broad authorizations might be issued. “If this is the case, then the potential breadth of the CSE’s new ability to monitor domestic infrastructure is deeply troubling. Were a communications company like or , for example, to request the CSE’s help and Cybersecurity Authorization be subsequently approved, it would then be legal for the CSE to intercept any or all of the private communications carried on that network.” The report also said provisions in the legislation regarding testing allow the CSE to direct its activities at Canadians and Canadian infrastructure if they are using the information for research and development purposes or testing. While that would happen only under ministerial authorization, it could be disruptive to networks because “there is no obligation to limit or tailor the scope and scale of testing operations under this exception,” it said. The report noted that “in the past, the CSE has carried out wide-ranging ‘tests’ implicating the data of hundreds of thousands of Canadians in a given city. The CSE’s cyber operation powers constitute some of its most disruptive capabilities.” “Allowing the Establishment free reign to unleash these capabilities on Canadian networks — even if just for testing or research purposes — can have serious implications for the integrity of networks and systems in Canada,” it said. The legislation also allows the CSE to test or evaluate products, software, and systems, again even if those activities are directed at Canadians or Canadian infrastructure. That paragraph includes the word “systems,” which in that context “clearly refers to networks and systems and within the global information infrastructure, i.e. the Internet,” the report said. It argued that gives the CSE the power to “probe Canadian networks and infrastructure remotely and surreptitiously. In effect, this bypasses the requirement for the CSE to obtain consent from a Canadian system operator prior to accessing its network and the limitation on CSE access to Canadian networks not deemed ‘critical’,” the report said. During that testing, the CSE could actively disrupt infrastructure, and the scope of the exception covering testing is extremely broad, it added. It could include connected cars and other components of the Internet of Things (IoT), smart grid systems and internet routers, and is “likely to most frequently include the full range of laptops, mobile devices, home computing devices, and network devices.” The report noted that there “is a tension inherent to the CSE’s mandate which requires the Establishment to simultaneously improve Canada’s cybersecurity while exploiting vulnerabilities in systems to facilitate surveillance as well as engaging in cyber operations against others. The exception encoded in paragraph 24(1)(c) allows the CSE to capitalize on this tension in deeply problematic ways that can have far-reaching implications for the integrity of communications networks and computing systems, and for the rights and interests of Canadians.” The report also noted that the prohibition CSE has on directing its activities to Canadians is difficult to enforce in an increasingly online world, calling it “largely a fiction.” “The reality of modern networked digital interactions is that it is inevitable that Canadian data will be deeply intermingled with non-Canadian data,” it said. “As the CSE is granted near limitless authority to capture any and all non-Canadian data as long as it operates within its mandate, it is openly anticipated that large volumes of Canadian data will be collected, used and analysed as an incidental byproduct of the CSE’s activities.” — With reporting by Anja Karadeglija at akarad@thewirereport.ca and editing by Bryson Masse at bmasse@thewirereport.ca

C-59 could hurt security, allow surveillance on telecom networks: report

News | December 19, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

C-59 could hurt security, allow surveillance on telecom networks: report

News | December 19, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Educating Canadians is key to address cybersecurity threats: CTS panel

Cybersecurity is national security, panelists tell IIC

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us