Communications Security Establishment

Activities

Unique within Canada's security and intelligence community, the Communications Security Establishment employs code-makers and code-breakers (cryptanalysis) to provide the Government of Canada with foreign intelligence and information technology security (IT Security) services. CSE also provides technical and operational assistance to the military, and federal law enforcement and security agencies including the Royal Canadian Mounted Police, Canada Border Services Agency and the Canadian Air Transport Security Authority.

Foreign Intelligence

As part of the Five Eyes, CSE works with its closest foreign intelligence allies, the US, UK, Australia and New Zealand to share the collection burden and the resulting intelligence yield. Canada is a substantial beneficiary and participant of the collaborative effort within the partnership to collect and report on foreign communications.

During the Cold War, CSE's primary client for signals intelligence was National Defence, and its focus was the military operations of the then Soviet Union. Since the end of the Cold War, Government of Canada requirements have evolved to include a wide variety of political, defence, and security issues of interest to a much broader range of client departments.

While these continue to be key intelligence priorities for Government of Canada decision-makers, increased focus on protecting the safety of Canadians has prompted greater interest in intelligence on transnational issues, including terrorism.

Cyber Operations

CSE's mandate authorizes it to conduct foreign cyber operations that disrupt the capabilities of adversaries to help protect Canada and Canadians. Cyber operations conducted by CSE is broken down to defensive and active cyber operations, and must relate to international affairs, defence or security.

Defensive cyber operations authorizes CSE to defend Canadian systems against foreign cyber attacks. For instance, a cyber actor trying to steal information from a government network could be thwarted by CSE by disabling the cyber actor's server. In addition to government systems, the Minister of National Defence can designate systems of importance such as: energy grids, telecom networks, healthcare databases, banking systems, elections infrastructure in order for CSE to be authorized to defend them.

Active cyber operations authorizes CSE to take pre-emptive action against threats to Canada such as: terrorist groups, cyber criminals, transnational criminals, hostile intelligence agencies, state-sponsored hackers. For instance, CSE can disrupt an adversary's means of communication as part of a military operation.

Assistance to Federal Partners

CSE's mandate authorizes it to provide technical and operational assistance to federal partners including the military, law enforcement and other intelligence agencies. The type of assistance itself can include: the collection and processing of communications, technical solutions, linguistic support, and conducting operations.

While assisting, CSE operates under the requesting agency's legal authority and restrictions. This means that CSE can, in fact, target Canadians and individuals in Canada while operating under its assistance mandate, as long as the requesting agency has the legal authority to, such as a court-issued warrant.

Canadian Centre for Cyber Security

The Canadian Centre for Cyber Security (CCCS or Cyber Centre; French: Centre Canadien pour la Cyber Sécurité) is the Government of Canada authority responsible for monitoring threats, protecting national critical infrastructure against cyber incidents, and coordinating the national response to any incidents related to cyber security. Although its main focus is protecting federal government systems, other systems can be designated as systems of importance by the Minister of National Defence under special circumstances.

As a unit under the Communications Security Establishment (CSE), the agency is Canada's computer emergency response team (CSIRT) and the Canadian government's computer Incident response team (CIRT).

Officially created on 1 October 2018, CCCS consolidated the existing operational cyber-security units of several federal government organizations, including Public Safety Canada's Canadian Cyber Incident Response Centre, Shared Services Canada's Security Operations Centre, and CSE's Information Technology Security branch.

History

Formerly known as communications security (COMSEC), CSE's Information Technology Security branch grew out of a need to protect sensitive information transmitted by various agencies of the government, especially the Department of Foreign Affairs and International Trade (DFAIT), Canada Border Services Agency (CBSA), DND, and the Royal Canadian Mounted Police (RCMP).

The Cyber Centre was developed in response to CSE's consultations with Canadians in 2016 which identified various issues pertaining to cyber security in relation to the federal government, including accountability, departmental coordination, and leadership. In February 2018, the federal budget allocated funds for CSE, in collaboration with Public Safety Canada and Shared Services Canada, to launch the Cyber Centre.

Officially created on 1 October 2018, CCCS consolidated the existing operational cyber-security units of several federal government organizations, including the Canadian Cyber Incident Response Centre of Public Safety Canada; the Security Operations Centre of Shared Services Canada; and the Information Technology Security branch of CSE.

Prior to opening, in June 2018, Minister Ralph Goodale appointed Scott Jones the head of the new Centre.

In 2024-25, CSE reportedly used the Cyber Centre's automated defence systems to defend against a total of 2.3 trillion malicious actions. This averages to around 6.3 billion a day.

Vulnerability Research Centre

The Vulnerability Research Centre (VRC; French: Centre de Recherche sur les Vulnérabilités) is part of CSE's Research Directorate. Its focus is to advance Canada's interests through world-class strategic vulnerability research. To do so, the VRC:

• conducts security reviews against systems of importance to the Government of Canada
• researches computer security vulnerabilities through source code auditing, software reverse engineering and dynamic analysis
• provides advice and guidance on vulnerability prevention and mitigation
• researches and develops novel vulnerability research techniques and tradecraft
• collaborates with other Government of Canada departments, international partners and other CSE divisions to promote the exchange of expertise
• performs recruitment, training and mentorship to help develop the next generation of vulnerability research practitioners within Canada

The VRC augments its capabilities by partnering with universities, such as the following publicly revealed so far: the University of Toronto, Ontario Tech University, and Concordia University.

Tutte Institute for Mathematics and Computing

The Tutte Institute for Mathematics and Computing (TIMC) is a research institute programme of the Government of Canada responsible for conducting both classified and unclassified research in the areas of cryptology and knowledge discovery to support the Canadian Cryptologic Program and its Five-Eyes international partners.

Though officially founded in 2009, TIMC officially opened and formally named in September 2011. Named after cryptanalyst and mathematician William T. Tutte, TIMC is based within CSE's Edward Drake Building in Ottawa.

Sponsored and funded by the Communications Security Establishment, the institute is partnered with Institute for Defence Analysis: CCR Princeton, CCR La Jolla, CCS Bowie; the Heilbronn Institute for Mathematical Research, Carleton University, and the University of Calgary and is working to create partnerships with other research institutes, government agencies and universities. Led by Dr. Drew Vandeth, CSE researchers proposed and established the institute. The institute's first director was Dr. Hugh Williams with Dr. Drew Vandeth as the first Deputy Director.

Unclassified Academic & Open-Source Contributions

Researchers Leland McInnes and John Healy at the Tutte Institute developed a technique called Uniform Manifold Approximation and Projection (UMAP), originally designed to analyze malware. The algorithm and software of UMAP has since been released by TIMC to the open-source community. UMAP has become an instrumental tool used by scientist to analyze large datasets such as when developing AI, or bioinformatics research with the case of the COVID-19 pandemic.

As of 2024-25, TIMC's open-source contributions averaged over 2.5 million downloads per month and have been adapted to NVIDIA's RAPIDS and HypernetX.

Facilities

CSE occupies two buildings in Ottawa. In 2015, CSE inaugurated their headquarters at the new Edward Drake Building, named for Lt. Colonel Edward Drake, a pioneer of the Canadian signals intelligence. With the launch of the Canadian Centre for Cyber Security in 2018, CSE expanded into a second location at 1625 Vanier Parkway. 1625 Vanier Parkway is also home of the Learning Hub, which runs cyber security and communications security training for Government of Canada employees. CSE formerly occupied the Tilley Building, located at 719 Heron Road starting in June 1961, before moving to the Edward Drake Building. The building was named in honour of Samuel Leonard Tilley, federal Finance Minister in 1873–1878.

The CSE utilizes two FRD-10 Wullenweber Circularly disposed antenna arrays in Gander, Newfoundland (48°57′04″N 54°31′31″W / 48.9511°N 54.5252°W) and Masset, British Columbia (54°01′44″N 132°03′55″W / 54.0288°N 132.0654°W) for radio direction finding. They are used to triangulate radio signals to gather signals intelligence, radio navigation, search and rescue, and enforcement of broadcasting laws.

Insignia

CSE uses generic identifiers imposed by the Federal Identity Program. However, CSE is one of several federal departments and agencies (primarily those having law enforcement, security or regulatory functions) that have been granted a badge by the Canadian Heraldic Authority. The badge was granted in 1994, while CSE's pennant was first raised in 1996 to mark the organization's 50th anniversary.

From the 1990s to the mid 2000s, CSE's Information Technology Security program used a logo to identify its products and publications. The triangle represented threats, while the arc symbolized protection.

Tools & Equipment

Code breaking equipment

CSE code breaking capabilities degraded substantially in the 1960s and 1970s but were upgraded with the acquisition of a Cray X-MP/11 (modified) supercomputer delivered to the Sir Leonard Tilley building in March 1985 and the hiring of code breaking analysts. It was, at the time, the most powerful computer in Canada. In the early 1990s, the Establishment purchased a Floating Point Systems FPS 522-EA supercomputer at a cost of $1,620,371. This machine was upgraded to a Cray S-MP superserver after Cray acquired Floating Point Systems in December 1991 and used the Folklore Operating System supplied by the NSA in the US. These machines are now retired.

Little information is available on the types of computers used by CSE since then. However, Cray in the US has produced a number of improved supercomputers since then. These include the Cray SX-6, early 2000s, the Cray X1, 2003 (development funded in part by the NSA), Cray XD1, 2004, Cray XT3, Cray XT4, 2006, Cray XMt, 2006 and Cray CX1, 2008. It is possible that some of these models have been used by CSE and are in use today.

Governance and mandate

Legislation

In addition to those mentioned below, CSE is bound by all other Canadian laws, including the Criminal Code, the Canadian Charter of Rights and Freedoms, the Privacy Act, Security of Information Act, and the Avoiding Complicity in Mistreatment by Foreign Entities Act.

In December 2001, the Canadian government passed omnibus bill C-36 into law as the Anti-Terrorism Act. The Act amended portions of the National Defence Act and officially recognized CSE's mandate.

The Anti-Terrorism Act also strengthened CSE's capacity to engage in the war on terrorism by providing needed authorities to fulfill its mandate.

In the 2007 Proceedings of the Canadian Senate Standing Committee on National Security and Defence, then-CSE Chief John Adams indicated that CSE is collecting communications data when he suggested that the legislation was not perfect in regard to interception of information relating to the "envelope."

Communications Security Establishment Act

In June 2019, the Communications Security Establishment Act (CSE Act) was passed, as part of the National Security Act 2017. The Act came into force two months after passing.

The CSE Act requires that CSE activities do not target Canadians anywhere in the world, or any person in Canada, "unless there are reasons to believe that there is an imminent danger of death or serious bodily harm. The Act also requires protect the privacy of Canadians and persons in Canada. As such, CSE is forbidden, by law, to intercept domestic communications. When intercepting communications between a domestic and foreign source, the domestic communications are destroyed or otherwise ignored. (After the September 11 attacks on the United States in 2001, however, CSE's powers expanded to allow the interception of foreign communications that begin or end in Canada, as long as the other party is outside the border and ministerial authorization is issued specifically for this case and purpose.)

Governance and oversight

The Minister of National Defence guides and authorizes the activities of CSE using ministerial directives, ministerial authorizations, and ministerial orders, all of which are based on the "government's intelligence priorities as set out by Cabinet through discussion and consultations with the security and intelligence community." The Defence Minister cannot authorize any activities that are not included in the CSE mandate or grant CSE any powers that do not exist in Canadian law.

Ministerial directives are how the Minister of National Defence instructs the Chief of CSE.

CSE operates under a system of independent oversight:

• National Security and Intelligence Review Agency (NSIRA) – NSIRA is fully independent of government and of CSE. Its committee members are appointed by the sitting prime minister in consultation with Parliamentary leaders, and handle complaints against all Canadian national security agencies.
• Intelligence Commissioner – the Intelligence Commissioner is independent of CSE and has oversight of all national security and intelligence gathering activities of the Government of Canada, including CSE. The Commissioner issues an annual report to the Prime Minister, who must table it in Parliament after removing confidential and classified information. The Commissioner is entitled to receive all reports that are compiled by NSIRA.
• National Security and Intelligence Committee of Parliamentarians (NSICOP) – NSICOP is a committee of Parliamentarians that have the security clearances to review and report on any aspect of CSE's activities.

CSE activities are also subject to several external oversight and review bodies.

As with any other federal department or agency of Canada, the activities of CSE are also subject to review by various federal bodies, including:

• the Privacy Commissioner
• the Information Commissioner
• the Auditor General
• the Canadian Human Rights Commission
• the Commissioner of Official Languages

Heads of CSE

Communications Security Establishment Commissioner

Oversight over CSE was formerly provided by the Office of the Communications Security Establishment Commissioner (OCSEC; French: Bureau du commissaire du Centre de la sécurité des télécommunications, BCCST), which was created on 19 June 1996 to review CSE's activities for compliance with the applicable legislation, accept and investigate complaints regarding the lawfulness of the agency's activities, and to perform special duties under the 'Public Interest Defence' clause of the Security of Information Act. The Commissioner provided an annual public report on his activities and findings to Parliament, through the Minister of National Defence.

Between 1996 and 2019, there were six Commissioners:

• Claude Bisson (1996 June 19 – 2003)
• Antonio Lamer (2003 June 19 – 2006)
• Charles Gonthier (2006 August 1 – 2009)
• Peter Cory (2009 December 14 – 2010)
• Robert Décary (2010 June 18 – 2013)
• Jean-Pierre Plouffe (2013–2019)

As part of an omnibus national security bill (the National Security Act 2017) passed by Parliament in 2019, the OCSEC was abolished and its responsibilities divided between two newly created entities: employees of the OCSEC were transferred to the Office of the Intelligence Commissioner; and the review functions of the former OCSEC were assumed by the National Security and Intelligence Review Agency (NSIRA).

The previous Commissioner of CSE, Jean-Pierre Plouffe, was appointed to the role of Intelligence Commissioner on 18 July 2019.

ECHELON

Under the 1948 UKUSA agreement, CSE's intelligence is shared with the U.S. National Security Agency (NSA), the British Government Communications Headquarters (GCHQ), the Australian Signals Directorate (ASD), and New Zealand's Government Communications Security Bureau (GCSB).

Along with these services from the United States, the UK, New Zealand, and Australia, CSE is believed to form the ECHELON system. Its capabilities are suspected to include the ability to monitor a large proportion of the world's transmitted civilian telephone, fax and data traffic. The intercepted data, or "dictionaries" are "reported linked together through a high-powered array of computers known as 'Platform'."

Controversies

CBNRC and the information it gathered and shared was kept secret for 34 years until 9 January 1974, when the CBC Television documentary show, The Fifth Estate, aired an episode focused on the organization, with research by James Dubro. This was the first time that the organization had ever been mentioned in public. This resulted in an outcry in the House of Commons and an admission by the Canadian government that the organization existed.

A former employee of the organization, Mike Frost, claimed in a 1994 book, Spyworld, that the agency eavesdropped on Margaret Trudeau to find out if she smoked marijuana and that CSE had monitored two of former British prime minister Margaret Thatcher's dissenting cabinet ministers in London on behalf of the UK's secret service.

In 1996, it was suggested that CSE had monitored all communications between National Defence Headquarters and Somalia, and were withholding information from the Somalia Inquiry into the killing of two unarmed Somalis by Canadian soldiers.

In 2006, CTV Montreal's program On Your Side conducted a three-part documentary on CSE naming it "Canada's most secretive spy agency" and that "this ultra-secret agency has now become very powerful," conducting surveillance by monitoring phone calls, e-mails, chat groups, radio, microwave, and satellite.

In 2007, former Ontario lieutenant-governor, James Bartleman, testified at the Air India Inquiry on May 3 that he saw a CSE communications intercept warning of the June 22, 1985 bombing of Air India Flight 182 before it occurred. Two former CSE employees have since testified that no CSE report was ever produced.

In 2013, a coalition of civil liberties associations launched a campaign directed against the government's perceived lack of transparency on issues related to the agency, demanding more information on its purported domestic surveillance activities.

Further criticism has arisen surrounding the construction costs of the agency's new headquarters in Ottawa. The project is slated to cost over CA$1.1 billion, making it the most expensive government building in Canadian history.

In 2014, a leaked, top-secret presentation entitled “IP Profiling Analytics & Mission Impacts” summarized experiments tracking the cellphones of travellers passing through Toronto Pearson International Airport. Critics argued that the experiment was invasive and indiscriminate, while CSE countered that it was consistent with all relevant laws and mandates.

In 2016, CSE Commissioner found that one of the agency's metadata activities did not comply with the law. Specifically, CSE had failed to properly minimize certain Canadian identity information before sending it to foreign governments, contravening parts of the National Defence Act and the Privacy Act.

Media portrayal

In The Good Wife episode "Landing," both the NSA and CSE are shown monitoring personal phone calls and hacking private cell phones' recording devices in order to listen in on personal conversations. One plaintiff describes CSE as "the Canadian version of the NSA."