Canada's electronic spy agency stops sharing some metadata with partners

The Communications Security Establishment,Canada's electronic spy agency,has stopped sharing certainmetadatawith international partners after discovering it had not been sufficientlyprotecting that information before passing it on.

Defence MinisterHarjit Sajjan says the sharing won't resume until he is satisfied that the proper protections are in place. Metadatais information that describes other data, such as an emailaddress or telephone number, but not the content of a given email or recording of a phone call.

The issue is disclosed in the annual report of CSE commissionerJean PierrePlouffe, which was tabled in the House of Commons Thursday morning.

• CSIS obtained confidential taxpayer data without warrants
• CSE worried about use of Canadian metadata
• CSEC's collection of metadata shows ability to 'track everyone'
• CSEC used airport Wi-Fi to track Canadian travellers: Snowden docs

"While I was conducting this current comprehensive review, CSE discovered on its own that certainmetadatawas not being minimized properly,"Plouffeexplained in the report.

"Minimization is the process by which Canadian identity information contained inmetadatais rendered unidentifiable prior to being shared ."

"The fact that CSE did not properly minimize Canadian identity information contained in certainmetadataprior to being shared was contrary to the ministerial directive, and toCSE'soperational policy."

Canada's Five Eyes partners, with which data is sometimes shared, are the United States, Australia, New Zealand and the United Kingdom.

The report also noted that "themetadataministerial directive lacks clarityregarding the sharing of certain types ofmetadatawith Five Eyespartners, as well as other aspects ofCSE'smetadataactivities."

Plouffe goes on to saythat the ministerial directive is unclear about key aspects of how CSE collects,uses and discloses metadata, anddoes not provide clear guidancefor how CSE's metadataactivities are undertaken, recommending the agency ask fora new directive to provide better guidance.

In a statement,Sajjansays the"metadatain question did not contain names or enough information on its own to identify individuals" and that "taken together with CSE's suite of privacy protection measures, the privacy impact was low."

He added: "I am reassured that the commissioner's findings confirm themetadataerrors that CSE identified were unintentional, and am satisfied with CSE's proactive measures, including suspending the sharing of this information with its partners and informing the Minister of Defence."

Sajjan said CSE won't resume sharing this information with Canada's partners until he is fully satisfied the effective systems and measures are in place."

Speaking to reporters on Parliament Hill, Sajjandid not specify what sort of metadatahad been shared and said officialscould not review the data to determine how many people might have been impacted without violating privacy laws.

Appearing alongside Sajjan, Public Safety Minister Ralph Goodalenoted that the federal government is in the process of reviewing its security intelligence operations and is committed to introducing new parliamentary oversight of intelligence agencies.