Spy agency says it 'improperly' shared Canadians' data with international partners

One of Canada's intelligence agencies says it "improperly" shared information about Canadians that it had obtained "incidentally" with international partners.

The Communications Security Establishment (CSE) shared some details about the incident after the intelligence commissioner — the quasi-judicial position that reviews the cyber spy agency's activities — flagged the case in his annual report tabled in Parliament earlier this week. 

CSE spokesperson Janny Bender Asselin told CBC News that last year the agency had to notify the defence minister "of an incident where CSE improperly shared information."

"CSE identified an activity where, between 2020 and 2023, we shared some information with international partners without properly removing Canadian information that had been acquired incidentally when targeting valid foreign intelligence targets," she said.

"CSE acted quickly to contain the issue."

The CSE is considered one of Canada's intelligence crown jewels, responsible for intercepting and analyzing foreign electronic communications, launching cyber operations and defending the government's networks and critical infrastructure from attacks. 

Asselin said that included seeking assurances from CSE's trusted partners that the shared information was deleted.

"We continue to update our policies and procedures to prevent reoccurrence," she said. 

CSE did not say how many Canadians were impacted or to which countries the information was shared, citing operational security. 

Details were shared with Intelligence Commissioner Simon Noël, who raised it in his recently published report.

The commissioner is part of the chain of approval before CSE and its sister agency, the Canadian Security Intelligence Service (CSIS), can go ahead with certain intelligence-gathering and cybersecurity activities. 

CSE first needs to seek permission from the minister of defence — known as ministerial authorization — if the proposed action would otherwise break the law or potentially infringe on the privacy interests of Canadians. 

Under the law, ministerial authorizations must prove the activities are reasonable, necessary and that measures are in place to protect Canadians' privacy. 

The intelligence commissioner then provides a layer of oversight and either signs off on the mission, approves with conditions or denies the request outright.