CSIS broke law by keeping sensitive metadata, Federal Court rules

A Federal Court judge says Canada's spy agency illegally kept potentially revealing electronic data about people over a 10-year period.

In a hard-hitting ruling made public Thursday, Justice Simon Noel said the Canadian Security Intelligence Service breached its duty to inform the court of its data-collection program, since the information was gathered using judicial warrants.

CSIS should not have retained the information since it was not directly related to threats to the security of Canada, the ruling said.

"Ultimately, the rule of law must prevail," Noel wrote, adding, "without it, the actions of people and institutions cannot be trusted to accurately reflect the purpose they were entrusted to fulfil."

CSIS crunched the data beginning in 2006 using a powerful program known as the Operational Data Analysis Centre to produce intelligence that can reveal specific, intimate details about people the spy service investigates, the judge said.

The improperly retained material was metadata — information associated with a communication, such as a telephone number or email address, but not the message itself.

However, it is difficult to determine the precise nature of the metadata involved due to heavy redactions to the 126-page court ruling.

At a hastily arranged news conference late Thursday, CSIS director Michel Coulombe said the spy service had halted all access to, and analysis of, the data in question while it thoroughly reviews the court decision.

"I deeply regret the court's serious concerns with respect to meeting our duty of candour, and I commit to continuing my efforts, with the deputy minister of justice, to address this concern," Coulombe said.

Sifting through data can help CSIS identify patterns of movement, communication, behaviours, significant trends and links that are otherwise unidentifiable, he added.

The ruling said the CSIS data analysis grew out of the spy service's concerns in the early 2000s that the information it collected was not being fully utilized and should be processed using more modern techniques.

That should not mean an expansion of the CSIS mandate approved by Parliament, Noel wrote.

"The evolution of technology is no excuse to flout or stretch legal parameters. When the information collected does not fall within the legal parameters delimiting the agency's functions and actions, it cannot legally be retained."

Noel said he considered ordering destruction of the relevant metadata collected since 2006, but decided against it because, in part, he did not hear legal arguments on the question.

He suggested it may be time to revisit the CSIS Act of 1984, which is "showing its age" in a technologically advanced world.

"Canada can only gain from weighing such important issues once again," Noel wrote. "Canadian intelligence agencies should be provided the proper tools for their operations but the public must be knowledgeable of some of their ways of operating."

It is the second time in three years the spy agency has felt the wrath of the court.

In a key 2013 ruling, Federal Court Justice Richard Mosley chastised CSIS over a request for warrants to track two Canadians with help from the Communications Security Establishment, Canada's electronic spy agency.

Mosley said CSIS breached its duty of candour by failing to disclose that CSE's foreign counterparts in the Five Eyes intelligence network — the United States, Britain, Australia and New Zealand — could be called upon to assist.

In Thursday's judgment, Noel said that given Mosley's ruling, "I wonder what it will take to ensure that such findings are taken seriously. Must a contempt of court proceeding, with all its related consequences, be necessary in the future?"