Canada’s spies are on the verge of new offensive powers for cyber attacks

Canada’s digital spy agency is on the verge of unprecedented new powers to launch secret cyberattacks against foreign governments with minimal oversight if the Liberals pass proposed legislation, researchers said in a report on Monday.

The Communications Security Establishment (CSE) relies on secretive legal interpretations that legitimize bulk data collection and mass surveillance activities, and those powers will be dramatically expanded if the government passes bill C-59, the report said.

The bill would mark the first time the agency would be legally authorized to launch offensive cyberattacks and sabotage since its creation in 1946, said the report from The Citizen Lab at the University of Toronto and the Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic at the University of Ottawa.

“The absence of meaningful safeguards or restrictions on the CSE’s active and defensive cyber operations activities… have the potential to seriously threaten secure communications tools, public safety, and global security,” warned the 71-page report.

The authors lambasted the proposed law due to, "weak and vague protections for the privacy of Canadians … alongside an abject disregard for privacy rights as an international human rights norm."

'Subverting information infrastructure'

The report comes as western governments are increasingly focused on preparing for cyberattacks, both offensive and defensive, in the wake of concerns from U.S. spy agencies that Russian-backed hackers attempted to sway the 2016 Presidential election in Donald Trump’s favor.

Giving spy agencies clearance to launch offensive attacks, however, isn’t the best way to respond to these cyber-threats, the report said.

Researchers expressed “concerns regarding the framework for the CSE’s acquisition of malware, spyware and hacking tools, which may legitimize a market predicated on undermining and subverting, rather than strengthening, the security of the global information infrastructure.”

A spokesperson for the electronic spy agency told the Toronto Star that “all of CSE’s activities would be subject to review” by a Parliamentary committee as part of the proposed law which was tabled in June.

The researchers, however, worry that warrants to launch surveillance or offensive operations would not have to approved by the courts under the new regime. The CSE says that - as a spy agency targeting foreigners rather than Canadians - parliament instead of the courts should be responsible for signing off on actions abroad.

“CSE is a foreign intelligence and cyber security organization, not a domestic security or law enforcement agency. Warrants for law enforcement … are generally for specific targets or operations … whereas CSE’s ministerial authorizations authorize a class of activities,” the CSE’s spokesman said.

Bill C-59 is under consideration by Parliament’s national security committee and discussions will continue in 2018