Sections 12 and 21 of the Canadian Security Intelligence Service Act, RSC 1985, c C-23 (Re)

Sections 12 and 21 of the Canadian Security Intelligence Service Act, RSC 1985, c C-23 (Re)
Court (s) Database
Federal Court Decisions
Date
2019-11-28
Neutral citation
2019 FC 1359
Decision Content
TOP SECRET
Date: 20191128
Docket: CONF-2-19
Citation: 2019 FC 1359
Ottawa, Ontario, November 28, 2019
PRESENT: The Honourable Madam Justice Kane
BETWEEN:
IN THE MATTER OF AN APPLICATION BY |||||||||||||||||||||||||||||||||||||||||||||||| FOR WARRANTS PURSUANT TO SECTIONS 12 AND 21 OF THE CANADIAN SECURITY INTELLIGENCE SERVICE ACT, RSC, 1985, C C-23
and
IN THE MATTER OF [CYBER THREATS] ||||||||||||||||||||||||||||||||||||||||||||
REASONS
KANE, J.
I. Overview
[1] In the context of the above noted Application, the Court noted that the warrant requested would include provisions that were similar to those considered by the Chief Justice in X (Re) 2017 FC 1048 (The BII Decision) and the Reasons issued in 2018 FC 874 (The BII Procedures Decision). (BII refers to Basic Identifying Information.) The Court questioned whether the concerns noted and findings made by the Chief Justice in the BII Decision and the process described in the BII Procedures Decision should apply to this Application or whether the different context permits the decisions to be distinguished.
[2] The Court’s questions, as amplified by the amicus curiae [the amicus] have been considered with the benefit of the submissions of the Attorney General of Canada [AGC] and of the amicus, the evidence of the affiant, |||||||||||||||||||||||||||||||||||||||||||, and the jurisprudence.
[3] In brief, I find that there are similarities between the issues considered and findings made in the BII Decision and BII Procedures Decision and the provisions at issue in this Application, namely Condition 3 and paragraph 5 (b) of the |||||||||||||||||||||||||||||||||||||| Warrant. The principles set out by the Chief Justice in these two decisions are not in dispute and have provided guidance. However, there are distinctions that can be made, including with respect to the nature of the threat being investigated and its fluid nature, the continuing nexus between the threat being investigated and the privacy interests that may be implicated, and the extent of the intrusiveness into the privacy rights of the individuals affected.
[4] Following their written and oral submissions to the Court, the amicus and Counsel for the AGC continued to discuss their respective positions. As a result, CSIS proposes to amend paragraph 5 (b) and certain conditions of the |||||||||||||||||||||||||||||||||||||| Warrant to ensure that the provisions at issue reflect both the underlying jurisprudence and the need for CSIS to execute the warranted powers to investigate |[[cyber threats]
[5] I have concluded that Condition 3, as presently worded in the |||||||||||||||||||||||||||||||||||||| Warrant in the context of [cyber threats] at issue, is the appropriate way to ensure that the warrant is executed in accordance with the authority granted by the Court with respect to |[investigative interests]| ||||||| not specified at the time the warrant is issued, and that a fresh warrant application would not be required in this context. However, I also agree that the proposed amendments (more fully described below) provide added safeguards and should be implemented.
[6] I have also concluded that paragraph 5(b) is not an unlawful delegation of a judicial function in the context of [cyber threats]| | ||||. This context is sufficiently distinct from that in the BII Decision. Paragraph 5 (b) does raise similar concerns to those noted by the Chief Justice in the BII Decision because it delegates to the Director at CSIS the authority to obtain additional subscriber information based on the determination by a Chief at CSIS that comes to light after the Designated Judge has issued the warrant. Paragraph 5 (b) of the |||||||||| warrant is currently not subject to Condition 3; in other words, there is no requirement to seek the authority of the Court to execute the power to obtain subscriber information from targets identified in the course of the investigation. Further consideration of whether paragraph 5(b) should be subject to Condition 3 may be advisable in some circumstances, in which case, the Designated Judge could impose such a condition. However, there are several differences between the subscriber information sought in reliance on paragraph 5 (b) in the |||||||||| warrant context than in the context of the BII Decision, which distinguishes the findings in the BII Decision.
[7] I also agree that the proposed amendments to paragraph 5(b) and the related amendment to Condition 5 will better ensure that the powers of CSIS are appropriately narrowed.
[8] To better understand my conclusions and how the proposed amendments respond to residual concerns, I will describe the relevant background to this Application, the provisions at issue, the guidance from the BII Decision and BII Procedures Decision, how BII can be distinguished from subscriber information in the |||||||||| warrant context, the positions of the amicus and the Attorney General, and the proposals which CSIS intends to adopt on a go- forward basis.
II. The Provisions at Issue
A. Condition 3 of the |||||||||||||||||||||||| Warrant
[9] Condition 3 states,
Where, pursuant to paragraphs 1(c), 2(c), 3(a) (ii), 3(b) (ii) and 4(b), the Chief or his designate has identified a |||||||||||||| ||[further investigative interest]||, for the purpose of executing this warrant, an application shall be brought to the Court, without delay, to seek authority to execute the warrant powers in respect of the identified | [further investigative interests]||| |||| [Emphasis Added]
(Paragraphs 1(c), 2(c), 3 (a) (ii), 3 (b) (ii) and 4(b) refer to “any other ||||||||||||||||||||||||||||||||||||||||||||||||||||”, “any other ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||” or “any other ||||||||||||||||||||||||||||||||||||||||||||” as applicable. Condition 3 requires CSIS to seek the Court’s authorization to execute the interception or other warranted powers with respect to the [identified further investigative interests]|||||| || |||||||||||| |||||||||||||||||||||| i.e., those that have not been set out in the warrant.)
[10] The question raised by the Court and amicus regarding Condition 3 is whether the process by which CSIS obtains further authorization to execute any of the initial warrant powers against new investigative interests is lawful.
[11] The amicus’ initial position was that this is a new intrusion into the privacy of an individual and is, therefore, a new search, which must be authorized in the same manner as the initial warrant.
B. Paragraph 5(b) of the |||||||||||||||||||||| Warrant
[12] Paragraphs 5 (b), (c) and (d) state,
5. I authorize the Director and any employee of the Service acting under his authority to:
[…]
(b) obtain subscriber information relating to any |||||||||||||||||| account where a Chief determines that the account was identified during the investigation of the threat to the security of Canada and the identity of the subscriber to the account will assist in the investigation of the threat to the security of Canada;
(c) obtain the |||||||||||||||||||||||||||||||||| used to |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| referenced in 5(b), and the |||||||||||||||||||||||||||||||| it was used; and
(d) obtain the |||||||||||||||||||||||||||| used to |||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| it was used and the corresponding subscriber information.
[…]
[Emphasis Added]
These paragraphs delegate to the Director at CSIS the power to obtain subscriber information relating to |||||||||||||||||| accounts that subsequently come to the attention of CSIS based on a determination made by a Chief.
[13] The amicus questioned whether such a delegation is lawful, noting that the determination of whether a search is reasonably justified is a judicial function. The amicus noted that in the BII Decision, the Chief Justice rejected a similar delegation to the Director to authorize collection of BII based on the identification by a Chief at CSIS. The amicus argued that paragraphs 5 (b), (c) and (d) of the |||||||||||||||||||||||||||||||||||||||||| Warrant in the cyber threat context makes the same delegation, and in accordance with the BII Decision and the underlying jurisprudence, would be unlawful.
III. The BII Decision
[14] In the BII Decision the Chief Justice addressed three related issues, one of which focussed on whether the Court can authorize an employee of CSIS to obtain BII of a communications account that corresponds to a telephone number or an electronic identifier where a Chief determines that the account was identified during its investigation and that the BII will assist in its investigation.
[15] BII is described as consisting of the name and address of a subscriber to a communications account, [and the information relating to IP addresses in certain circumstances] |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[16] In the overview, the Chief Justice noted at para 6:
[6] Before the court may authorize CSIS to obtain BII or to exercise other intrusive search powers, the Court must have an understanding of the nexus between CSIS’s investigation and the specific persons or class of persons whose privacy rights would be engaged. Only then can the court assess whether the specific privacy interests of those persons must give way to the interests of the state in obtaining the information in question. In addition, CSIS must satisfy the requirements for obtaining a warrant set forth in subsections 21(2) and (3) of the Canadian Security Intelligence Act [the Act], in respect of such person or class of persons. [Emphasis Added]
[17] The Chief Justice explained that where the Court is not able to conduct the assessment required by section 8 of the Charter in respect of the specific individuals or class of individuals whose privacy interests would be engaged by CSIS gaining access to their BII, CSIS must return to the Court for authorization each time it identifies additional telephone numbers or electronic identifiers in order to obtain the BII. CSIS would be required to establish the nexus between the number or identifier and the investigation (i.e., the threat) to establish that there are reasonable grounds to believe that CSIS requires the BII of the account to advance the investigation.
[18] With respect to whether the Court could authorize CSIS to obtain BII relating to other numbers or electronic identifiers that come to its attention in the course of an investigation based on the determination by a Chief at CSIS, the Chief Justice found that this was a judicial function that could not be delegated.
[19] At para 14 of the BII Decision, the Chief Justice added: “Although the Court may delegate to CSIS certain types of decisions with respect to the execution of its warrants, it cannot delegate the determination of which specific communication accounts will be the subject of requests to CSPs [Communications Service Providers] for BII. To the extent that this determination requires an assessment of whether the privacy interests of the persons in question must give way to the interest of CSIS in obtaining the BII in question, this is a function that must be performed by the Court.”
[20] The Chief Justice considered the jurisprudence regarding the search power and section 8 of the Charter and provided a detailed analysis which led to his findings.
[21] The Chief Justice elaborated, at paragraphs 91- 94, on the issue of the delegation to a Chief at CSIS. In particular, the Chief Justice noted at para 93:
[93] An authorization for CSIS to engage in what amounts to a search that is more than minimally invasive in nature must be given by an entirely neutral and impartial arbiter who is capable of acting judicially in balancing the interests of the state against those of the individual whose privacy rights would be encroached upon (Spencer, above, at para 68; Goodwin, above, at para 56; Hunter, above, at 160-162; R v Thompson, [1990] 2 SCR 1111, at 1134; R v Grabowski, [1985] 2 SCR 434, at 445-446).
[22] The Chief Justice provided this summary at para 99:
[99] In summary, the Court cannot authorize an employee within CSIS to obtain BII corresponding to a telephone or an electronic identifier, where a “Chief” within CSIS determines that the account was identified during its investigation, and that the BII would assist CSIS in its investigation. Determinations as to which specific communications accounts maybe the subject of requests to CSP’s for BII must be made by a designated judge of this Court. Allowing such determinations to be made by a Chief within CSIS would constitute an impermissible delegation of the Court’s responsibility to determine whether the grounds to be met before an individual’s privacy interests can be intruded upon, have been met. Moreover, Chiefs within CSIS would not have the required degree of neutrality and impartiality to perform this important function.
[23] The BII Decision is relevant to the consideration of the lawfulness of Condition 3 and paragraph 5 (b) in the |||||||||||| warrant context.
IV. The BII Procedures Decision
[24] In the subsequent BII Procedures Decision, at para 95, the Chief Justice addressed proposed provisions similar to Condition 3 of the |||||||||||||||||||||||||||||||||||||||| Warrant and set out the approach to be followed by CSIS on a go forward basis, which CSIS agreed would be adopted:
[95] Based on representations made to the Court… it appears as though an understanding has now been reached as to the basic approach that CSIS and the Attorney General will follow when seeking judicial authorization from this Court to obtain BII from CSP’s in respect of one or more telephone numbers or electronic identifiers that may come to CSIS’s attention during the course of an investigation. In brief that approach is as follows:
i. A fresh application will be filed, supported by a fresh affidavit that provides the facts relied upon to satisfy the Court of the matters referred to in paragraphs 21(2) (a) and (b) of the Act. For greater certainty, these matters will include the required nexus between the relevant investigation being conducted by CSIS and the telephone number (s) or electronic identifier(s) in respect of which CSIS seeks an authorization to obtain BII. To satisfy the Court with respect to that nexus, the facts adduced by CSIS’s affiant must provide reasonable grounds to believe that the individuals behind each of the [electronic identifiers] |||||||||||||||||||||||||||||||||||||||| in question either may be involved in the identified threat posed to the security of Canada that CSIS is investigating, or may be able to provide information to assist CSIS’s investigation into the that threat.
ii. A fresh designation and approval of the Minister, and a fresh confirmation of consultation from the Deputy Minister, will be filed in respect of such application.
iii. In urgent situations where it is not possible to obtain the Minister’s designation /approval or the Deputy Minister’s confirmation of consultation, in writing, it will suffice if the Attorney General or her representatives (i) advises the Court that such designation/approval and such confirmation have been provided orally, and (ii) undertakes to provide a written designation / approval and a written confirmation of consultation as soon as is reasonably possible.
[Emphasis Added]
[25] As an observation, the adoption of the approach set out in the BII Procedures Decision in the |||||||||||||||||||||||||||||||||||||||||| Warrant in the context of |[cyber threats]||||||| |||||| |||||||||||||||||||| would render Condition 3 meaningless.
V. How does subscriber information in this Application (|||||||||||||||||||||||||||||||||||||| Warrant) differ from BII?
[26] In the BII Decision, the Court addressed the circumstance where the individual, once identified, would be a subject of investigation or may be in a position to assist in the investigation. As noted, the Chief Justice found, among other things, that the nexus between the individual and the investigation into the threat must be established. The Court must be satisfied that there are reasonable and probable grounds to believe that the individuals behind the telephone numbers and electronic identifiers either may be involved in the identified threat to the security of Canada that CSIS is investigating or may be able to provide information to assist CSIS’s investigation of the threat.
[27] As explained by the affiant, ||||||||||||||||||||||||||||||||, in the |||||||||||| warrant context the target is the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||.
[28] |||||||||||||||||||||||||||||||| explained that subscriber information allows CSIS to find out |||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||. He noted that in this context, CSIS is more interested in |||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||. Although the identity of the |||||||||||||||||||||||||||||| is needed, |||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||| The subscriber information is needed to |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||
[29] |||||||||||||||||||||||||||||||| explained that CSIS would first ask the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||. CSIS would then approach the |||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| and would seek the subscriber’s consent to ||||||||||||||||||||||||||||||||||||||||||||||||||||||. If no consent is provided, CSIS would seek a further warrant from this Court.
[30] Although the amicus submits that BII and subscriber information are basically the same, the Chief Justice described BII more broadly, as including the name and address of a subscriber to a communications account, |||[and the information relating to IP addresses in certain circumstances] ||||||| |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||. The use of BII as considered in the BII Decision also differs from the use of subscriber information in the |||||||||||| warrant context.
VI. How does the initial warrant application made pursuant to sections 12 and 21 differ from the supplemental application contemplated by Condition 3?
A. The Application
[31] The application for the warrant at issue is typical of the current process. The application for the initial warrant included a detailed affidavit setting out how the warrant meets the statutory requirements of sections 12 and 21 to investigate [cyber threats] |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
[32] The affidavit described the nature of the ||[cyber threat]||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||, including what CSIS has learned about the methodology used and the characteristics of ||||||||||||||||||||||||||||||||. The affidavit also described how CSIS |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||.
[33] The affidavit described the powers sought in the warrant and why these are necessary.
[34] The affidavit explained that the ability to obtain subscriber information of individuals contacting or interacting with threat actors assists in the investigation by identifying the threat actor, |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||. The affidavit explained that the power to obtain subscriber information corresponding to any ||[electronic identifiers] ||| will allow CSIS to identify the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| and will allow CSIS to identify the victims of ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||.
[35] Of note, the affidavit specifically addressed the need for Condition 3, which permits CSIS to seek authority from this Court, without delay, to execute the warranted powers (e.g. to intercept, obtain a copy of data, obtain information) in respect of newly identified |||||||||||||||| |||||[investigative interests]|||| | identified during the life of the warrant.
[36] The affidavit included, among other exhibits: a description of |||||||||||||||||||||||||||||||||||||||||||||||||||||||| |||||||||| ||||||||||||||||||||||||||, what CSIS intercepts and obtains, how CSIS minimizes the impact on privacy of Canadians; and, the specific ||[investigative interests]||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| for which CSIS is seeking the warranted powers at that time.
[37] The affidavit attested that the Deputy Minister of Public Safety and Emergency Preparedness [PSEPC] had been consulted and that the Minister of PSEPC had designated the affiant to make the application and has approved the application. The signed consultation and approval were attached as Exhibits.
B. The Condition 3 “Supplemental” Application
[38] Condition 3 contemplates that CSIS would make an application in writing, by way of a letter to the Court noting that it seeks to rely on Condition 3, providing a brief explanation and attaching a short affidavit and a draft Order identifying the newly identified ||||||[investigative|| ||||| || interests] | || to be added to the |||| Warrant previously issued. The affidavit references the application for the initial warrant and the affidavit filed in support of that application, which provided extensive details (as noted above).
[39] This process has not required an oral hearing, although nothing prohibits the Court from requesting a hearing if the Court has concerns or questions. Alternatively, the Court could request additional information in writing. The application in writing is not accompanied by a new record of consultation with the Deputy Minister or new approval of the Minister as this would entail delays which would undermine or preclude CSIS’s ability to investigate |||[cyber | | threats]|||n ||||||||||||||.
[40] Although any Designated Judge could consider the supplemental application, and in doing so would review the warrant and the affidavit filed in support of the initial warrant application, where feasible, the same Designated Judge should consider the supplemental application which relies on Condition 3. The Designated Judge who heard the warrant application and granted the warrant would be familiar with the background information, including the nexus between the threat being investigated and the subscriber information being sought.
C. The Application made in ||||||||||||||||||||||; A Hybrid
[41] An application to the Court pursuant to Condition 3 was made during the currency of the warrant seeking to add new |[investigative interests]| | and seeking authorization for the warrant powers to be executed with respect to the new |[investigative| |interests] ||||||||||||||||.
[42] I have characterized the |||||||||||||||||||||||||||||||||||||||| application as a hybrid because CSIS sought an oral hearing of the application, provided an affidavit describing how the |[new investigative interests] |||||||||||||| had been identified and explained why it was necessary for CSIS to query the information. In addition, the application included documents confirming that the Deputy Minister of PSEPC had been consulted and the Minister of PSEPC had approved the application to add new |||| |[investigative interests]||||. Counsel for the Attorney General noted that this was an unusual step which had been taken because of the questions posed by the Court regarding Condition 3 for which submissions of the AGC and amicus were pending.
[43] The supplemental application was granted following a hearing.
VII. Is Condition 3 lawful, or is a fresh warrant application required to execute the warrant powers against additional |[investigative interests]?
A. The Amicus’ Position
[44] The amicus submits that CSIS is required to seek a fresh warrant pursuant to section 21 to obtain authorization to engage in an intrusion against new |||||[investigative interests]||| ||| |||||||||||||||||||| associated with ||[cyber threats] |. The amicus explains that additions requested by CSIS expand the number of individuals whose privacy interests would be engaged and intruded upon.
[45] The amicus submits that any intrusion requiring warrant powers requires judicial authorization, which in turn requires the judge to weigh the threat against the intrusion on the privacy of the investigative interest. In addition, the other statutory requirements for a warrant must be met: the Director, or an employee designated by the Minister, must believe, on reasonable grounds, that a warrant is required to enable the Service to investigate a threat to the security of Canada; the Director, or an employee designated by the Minister, must consult with the Deputy Minister regarding the application for a warrant; and, the Minister be made aware of the particular circumstances of the specific intrusion in order to determine whether to approve the application.
[46] The amicus characterizes Condition 3, as presently worded, as a blanket authorization to CSIS to seek judicial authority to conduct new intrusions without consideration of the specific circumstances that could justify the intrusion upon the privacy of individuals and without consultation with the Deputy Minister or approval of the Minister.
[47] The amicus submits that Condition 3 deprives the Minister of PSEPC of considering the factual nexus between the person whose privacy will be intruded upon and the threat.
[48] However, the amicus also acknowledges that in the context of [cyber threats] ||||||||||||||||||||||||, the nexus between the threat and the new [investigative interests] is the same as that described in the initial warrant, where the same [investigative interests] are attributed, and that the privacy interests of the individuals affected by the warrants are the same.
B. The AGC’s Position
[49] The AGC characterizes Condition 3 as a measure of control that applies at the time the warrant is executed with respect to the additional | [investigative interests] ||, because it requires that CSIS return to the Court to seek authorization to execute the powers against those added.
[50] The AGC submits that Condition 3 remains the best approach to execute the |||| warrant with respect to new |||[investigative interests]| ||||||||||| in the context of the investigation of |||[cyber threats] |||| given the “fluid nature” of those activities. There is no need (as in the BII Procedures Decision) for a “fresh” application to be made or for a new Ministerial Approval or new Deputy Minister consultation. The initial warrant application includes the Deputy Minister consultation and Ministerial Approval which applies to the warrant and its conditions throughout the life of the warrant.
[51] The AGC explains that at the time Condition 3 is invoked, the threat is known, the methods which gave rise to identifying the additional ||||[investigative interests]| | |||||||||||||||||||| have been established, and the type of communication to be intercepted or information to be obtained is the same. The extent of the intrusion of privacy has been considered by the Court at the time of the issuance of the initial Warrant and this remains the same for any additional ||||||[investigative interests]||||| |||. The AGC submits that the basis upon which the Minister of PSEPC approved the application for the initial warrant remains unchanged.
[52] The same facts that CSIS would establish if required to make a new application to execute the warrant powers against new targets have already been established for the purpose of the issuance of the initial warrant.
C. Condition 3 is a Lawful Condition
[53] Condition 3 permits CSIS to seek authorization to execute the warranted powers against newly identified ||||[investigative interests] |||||||||||||| without providing a new affidavit and without providing documents to show that the Deputy Minister of PSEPC has been consulted and that the Minister of PSEPC has approved the additions.
[54] Condition 3 ensures that the warrant is executed in accordance with the authority granted by the Court with respect to |||||||[further investigative interests] || |||||||| not specified at the time the warrant is issued. An application made to the Court pursuant to Condition 3 should not be characterized as a new application, rather as a supplemental application, which relies on the condition in the initial warrant (i.e. Condition 3) that operates for the duration of the warrant (which is not longer than one year). The Designated Judge who considers the supplemental application will have access to the application for the initial warrant and the affidavit(s) in support, the transcript of the hearing, the supplemental written application (which relies on Condition 3), and a shorter affidavit explaining why the newly identified |||||||[investigative|||||| ||||interests]|| ||||| should be added to the warranted powers. (As noted above, where feasible, it is preferable that the same Designated Judge consider the supplemental application.)
[55] The Designated Judge will consider the supplemental application and may issue the Order without an oral hearing (and without a new approval of the Minister of PSEPC or evidence of consultation with the Deputy Minister). However, if the Designated Judge is not satisfied that the Order should be made based on the written application or the supporting documents, the Judge could request an oral hearing and/or could request further documents.
[56] In the BII Procedures Decision, at para 95, the Chief Justice reiterated that where BII is sought from CSPs with respect to newly identified electronic identifiers, the correct approach is to bring a fresh application, with a fresh affidavit setting out, among other information, the nexus between the investigation and the identifiers, and a fresh designation and approval of the Minister of PSEPC and confirmation of consultation with the Deputy Minister of PSEPC. The Chief Justice explained that to satisfy the requirement for the nexus, the affiant should set out the reasonable and probable grounds for the belief that the individuals behind the identifiers may be involved in the threat or may be able to provide information to assist in the investigation into the threat.
[57] The Chief Justice emphasized that the Court must have an understanding of the nexus between the CSIS investigation and the “specific persons or class of persons” whose privacy rights would be engaged so that the Court can then assess whether the specific interests of those persons should give way to the interests of the state to obtain the information.
[58] The Application at issue- to execute warrant powers against newly identified targets in the |||||||||||| warrant context, relying on Condition 3- differs from the request for judicial authorization to obtain BII in the applications considered in the BII Decision. In the |||||||||||| warrant context, the threat is well established at the time of the initial warrant. The nexus between the ||[investigative interests] set out in the initial warrant as well as those identified in the course of the investigation and the threat being investigated is the same. In other words, the reasonable and probable grounds to believe that CSIS requires the subscriber information to investigate the threat remain the same for the newly identified targets.
[59] The extent of the intrusion into the privacy of the newly identified | [investigative|| || |||interests]| | ||||| is limited to identifying the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||. The outcome of the balancing exercise (i.e., whether the specific privacy interests of the persons |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| should give way to the interests of the state to obtain the information) that would be required at the stage of the initial warrant application and at the time of the supplemental application pursuant to Condition 3 are not specifically known but would generally be the same. As explained by ||||||||||||||||||||||||||||||||||, CSIS does not seek information about the individual or their lifestyle, but only their identity for the purpose of determining |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||. Any further intrusions, ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||, without consent, would require further authorization from the Court (i.e. a fresh warrant application).
[60] The concerns noted by the amicus regarding the protection of privacy arising from online anonymity, as recognized by the Supreme Court of Canada in R v Spencer 2014 SCC 43 [Spencer], at paras 47-48, do not arise. CSIS is not attempting to link a person’s online activity with their lifestyle choices or with any other aspect of the individual’s personal affairs, rather to ||||||||||||||||||||||||||||||||||||||||||||||||.
[61] The supplemental application which relies on Condition 3 must be carefully considered and approved by the Court, but does not require a fresh warrant application and all that is entailed. The Designated Judge will consider whether CSIS has established the need to add the new |||||[investigative interests] | ||||||||||||||||||||||||||||||||||||||||||| based on the information provided in the supplemental application with regard to all relevant information, including the initial warrant application.
[62] In this context, I find that a fresh approval by the Minister of PSEPC is not required to establish that the Minister is aware of the specific additions of |[investigative interests]. Similarly, the proof of consultation with the Deputy Minister of PSEPC is not required.
[63] The Deputy Minister and Minister of PSEPC would have been aware at the time of the request for the initial warrant that Condition 3 would permit the warranted powers to be executed against others who come to the attention of CSIS in the course of the investigation over the duration of the warrant (which does not exceed one year) and that Condition 3 requires the Court to authorize the additions, or in the words of Counsel for the Attorney General, to exercise a measure of control.
[64] Although I find that Condition 3 of the |||||||||||||||||||||||||||||||||||||||||| Warrant, as presently worded, is not unlawful, the proposal developed by CSIS and the amicus will provide an added safeguard that should be implemented. CSIS proposes to leave Condition 3 as is, and to amend Condition 4 to clarify that where the activity being investigated under the |||| warrant is |||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||, CSIS must bring a fresh application for a warrant. This new condition would address concerns about the nexus between the person(s) whose privacy rights would be engaged and the threat being investigated and would require the Minister to consider the particular circumstances of the search and the nexus to the identified threat. Where the activity relates to the threat described- i.e., where the nexus has already been established- there is no need for a fresh warrant.
[65] Condition 4 would be amended to add the wording in italics:
Within 21 days of the date on which the Chief or his designate determines the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||||||||||||||, the Court shall be advised in writing, of the ||||||||||||||||||||||||||||||||||||||||||||||||.
Should the |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||, a new application under section 21 of the CSIS Act shall be brought to the Court in respect of the |||||||||||| ||||.
[66] The proposed amendment would clarify that CSIS cannot rely on Condition 3 when |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||| ||||||||||||||||||||||||||||. In such cases, a fresh application would be required in order to execute the powers sought. Any information obtained and used pursuant to Condition 3 in the very short intervening period prior to CSIS bringing a new application under section 21 can be considered to have been lawfully obtained in exigent circumstances as long as it retroactively authorized by the Court as soon as possible.
VIII. Is Paragraph 5(b) an unlawful delegation of a judicial function?
A. The Amicus’ Submissions
[67] The amicus notes that Section 8 of the Charter requires judicial pre-authorization for a search, and submits that this includes a search for subscriber information.
[68] The amicus notes that to com