Intelligence watchdog questions cyber agency's approach to international law, CSE insists it was above board

One of Canada's intelligence watchdogs has scolded the country's cyber security agency over its approach to international law.

The National Security and Intelligence Review Agency reviewed the Communications Security Establishment's activities in 2019, the first year after it received new powers. While the review was completed in 2020, its report was made public only this week.

The CSE insists it never violated international law and is calling the matter a "philosophical" disagreement with its oversight body.

"CSE, because we are the ones who deal with foreign cyber operations, did not violate international law. We did not even come close to violating international law," Nabih Eldebs, CSE deputy chief of authorities, compliance and transparency, told CBC News.

"This was not in our ethos, this was not in our thinking."

CSE is empowered to gather foreign signals intelligence and defend Canada's national security, including government of Canada servers and networks. It also has a growing role in protecting Canada's critical infrastructure, such as banks, telecommunications and the energy industry.

To do all that, the agency was granted the ability in 2018 — with ministerial consent — to launch "active cyber operations" to disrupt threats from terrorist groups, hostile intelligence agencies and state-sponsored hackers.

As an example of what this power allows it to do, CSE says it can prevent a foreign terrorist group from communicating or planning attacks by disabling their communication devices.

In its report, NSIRA wrote that when it asked CSE to explain its legal obligations when launching such operations, the agency's response was lacking.

"CSE has not sufficiently examined its obligations under international law," said the intelligence review body in its heavily redacted report.

Eldebs said the federal government was still developing its official stance on cyberspace and international law as CSE was beginning to launch these operations.

"These were our new foray into foreign cyber operations," he said.

"I think, in my belief, it was a philosophical disagreement on the approach to international law between both organizations, not the importance of international law."

The government of Canada released a public statement on international law applicable to cyber space in 2021. Eldebs said the CSE now uses that statement as a guiding principle.