Monday, June 12, 2017

Canada's spies illegally retained metadata

Another day, another story about illegal spying. This time from Canada, where the Canadian Security Intelligence Service was found to be illegally retaining the metadata of innocent third-parties who called (or were called by) the targets of interception warrants:
When CSIS intercepted the communications of innocent people between 2006 and 2016 “all” the metadata related to those communications was retained in a controversial database, a top secret memo obtained by the Star suggests.

The document relates to CSIS’s Operational Data Analysis Centre (ODAC) and a now-discontinued program that stored data intercepted from the service’s targets — and people who were in contact with them at the time.

The Federal Court ruled in 2016 it was illegal for the service to indefinitely keep data on people who posed no threat to Canada’s national security — such as the family, friends or coworkers of CSIS targets — for future analysis.


Apparently CSIS claims it doesn't know how many people it illegally spied on in this manner - a simple database search apparently being beyond them. But its highly disturbing. These people were innocent, deemed irrelevant to any national security investigation. And yet their information was retained indefinitely for future mining. That's been stopped now, but it makes you wonder what else they're doing.

It also makes you wonder whether it is happening or has happened here. While New Zealand law has always required irrelevant information lawfully gathered under an intelligence warrant to be destroyed, its obviously open to game-playing about what's considered "irrelevant". And even if it is irrelevant for national security purposes, it can always be passed on to other agencies, either foreign intelligence services or the New Zealand police, if it "may assist" in their jobs. And given the "collect it all" mindset of the spies, they may very well decide that even the most innocuous information may assist one of these agencies, if not now, then at some indeterminate stage in the future (perhaps when a hypothetical incident occurs, and they ned to do network analysis to find any suspicious links). In the wake of the Canadian discoveries, I think our spies owe us some answers on this.