CSE activities under C-59 may weaken encryption tools: CCLA

OTTAWA — Parliamentarians debating Bill C-59 will have to come to grips with whether the Communications Security Establishment’s (CSE) new mandate under the proposed national security legislation could threaten communications tools, such as encryption, that secure data from prying state eyes. The comments heard by a committee Thursday specifically dealt with the proposal to give the CSE the ability to engage in defensive and offensive cyber operations that the Canadian Civil Liberties Association (CCLA) said would involve “secret and largely unconstrained” state-sponsored hacking and disruption. “Such activities are...bound to impact the privacy, expression and security interest of Canadians and persons in Canada, and may threaten the integrity of communications tools, such as encryption and anonymity software that are vital for the protection of human rights in the digital age,” CCLA research fellow Lex Gill said, addressing the House of Commons’ national security committee Thursday. Gill added that this is despite the legislation explicitly stating it prohibits the institution from directing those practices toward its citizens. Gill raised the concern of other allied intelligence agencies, who have engaged in activities in the past that interfered and undermined encryption and anonymity tools. Case in point: a meeting held in Ottawa in June brought five global security agencies, known as The Five Eyes and which includes the CSE, to reiterate their position that encryption could get in the way of public safety. The call faced a backlash from more than six dozen civil society organizations and individuals, who issued a letter backing stronger data encryption. The governments of the United States and the United Kingdom, both with membership in the Five Eyes, have previously requested that encryption be weakened or workarounds be created to aid in investigations. “Encryption can severely undermine public safety efforts by impeding lawful access to the content of communications during investigations into serious crimes, including terrorism,” the Five Eyes said in a joint communiqué. Gill faced questioning from NDP MP Matthew Dubé, who was subject to a CBC/Radio-Canada experiment that showed how easy it is to hack Canada’s mobile networks and intercept phone calls using a protocol known as Signalling System 7 (SS7). He asked whether Part 3, Section 24 of the bill, which includes “testing or evaluating products” like software for vulnerabilities, could create a situation where the CSE can find ways to counter encryption for lawful purposes. “I think we should be concerned about those types of operations,” Gill said. “Encryption and anonymity tools are vital to protecting the safety of Canadians and persons in Canada as well as Canadian infrastructure, so we should be concerned if the CSE ends up inadvertently working at cross-purposes by interfering with the very tools designed to protect us.” Gill also noted that there is no public framework for disclosing vulnerabilities wherein, for example, the CSE could disclose vulnerabilities to telecoms. However, she said that the CCLA has not formulated a concrete position on that. On Tuesday, the same committee heard arguments from University of Ottawa law professor Craig Forcese, who suggested that the legislation may also allow for unwarranted collection of data. Also appearing before the committee Thursday — which earlier in the session hosted privacy commissioner Daniel Therrien — was Christian Leuprecht, a professor at the Royal Military College of Canada, who said Canada is lagging behind on cybersecurity. “On the Five Eyes community, we have, by far, the most restrictive privacy regime,” Leuprecht said. He added that the government needs to strike a balance between having a review body to reassure the public that their privacy is protected, but also to allow some agility and flexibility to address threats. “You ultimately need ... effective and timely intelligence sharing, given how quickly cyber challenges and threats move,” Leuprecht said. He added that more work also needs to be done on transparency. “Any mechanism that the government can agree upon to inform people better and give ... organizations, such as CSE, more capacity to support small and medium-sized enterprise would be critical,” he said. Those are the businesses, he said, that generate much of the prosperity, innovation and employment in the country. “Cyber is the single greatest threat to our national security, to our democracy, our social harmony and our prosperity today,” Leuprecht said. “I think there is an opportunity to be more systematic in how we communicate that to Canadians.” — With reporting by Ahmad Hathout at ahathout@thewirereport.ca and editing by Anja Karadeglija at akarad@thewirereport.ca

CSE activities under C-59 may weaken encryption tools: CCLA

News | December 7, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us

CSE activities under C-59 may weaken encryption tools: CCLA

News | December 7, 2017

Unlock all the Canadian telecom, broadcasting and digital media news you need.

FREE TRIAL

SUBSCRIBE

Related Stories

Online harms and more in focus as Parliament returns

Telecoms and broadcasters hit by CrowdStrike IT outage

CRTC lacking in battle against cybercrime: Auditor General

Education key to combating foreign interference on social media, ETHI hears

Reuse & Permissions

Inside The Wire Report

Information

Hill Times Publishing

Get in Touch With Us