File breach at electronic spy agency prompts mandatory privacy training

Canada’s electronic spy agency introduced mandatory privacy awareness training for all employees in March following an internal breach involving personal information.

OTTAWA — Canada’s electronic spy agency introduced mandatory privacy awareness training for all employees in March following an internal breach involving personal information.

When Greta Bossenmaier became chief of the Communications Security Establishment in February, the ultra-secret eavesdropping outfit was under intense public scrutiny over alleged spying on citizens.

But less than two months into the job, Bossenmaier was informing the spy agency’s staff of a privacy violation inside its own walls.

“I seriously regret that we are in this situation and never want it to be repeated,” Bossenmaier told employees in a March 20 email. “As such, we must use it as a learning opportunity so that we can prevent any further incidents from occurring.”

The Ottawa-based CSE, which employs about 2,000 people, uses highly advanced technology to intercept, sort and analyze foreign communications for information of intelligence interest to the federal government.

Documents leaked in 2013 by former American spy contractor Edward Snowden revealed the U.S. National Security Agency — a close CSE ally — had quietly obtained access to a huge volume of emails, chat logs and other information from major Internet companies, as well as massive amounts of data about telephone calls.

As a result, civil libertarians, privacy advocates and opposition politicians have demanded assurances the CSE is not using its extraordinary powers to snoop on Canadians. The agency insists it scrupulously follows the law in protecting Canadians’ privacy.

On July 31, 2014, someone notified CSE’s corporate security officials that a file containing personal information related to security clearances was mistakenly given public-access permission markings, making it accessible to CSE personnel, according to Bossenmaier’s email to staff.

An edited version of her classified message was obtained by The Canadian Press under the Access to Information Act.

By November an internal probe determined the breach had potentially affected the personal information of 146 people. However, further examination led the agency to conclude in January that the sensitive personal information of just five individuals — four CSE employees and one member of the public — was deemed to be at risk.

“The investigations determined that the incident was caused by a combination of technical and human errors,” Bossenmaier told staff. “Several of CSE’s existing security safeguards mitigated the risk of the information being further compromised or removed from CSE premises.”

CSE spokeswoman Lauri Sullivan declined to elaborate on the nature of the information.

The CSE advised the Treasury Board Secretariat, the federal privacy commissioner and the watchdog that keeps an eye on the spy agency.

In February and March, the CSE informed the five individuals, Sullivan said in written answers to questions. “This involved extensive co-ordination between CSE’s Privacy Office, senior management, security, labour relations, and CSE’s Counselling and Advisory Program.”

The CSE ushered in a new policy last September on administrative privacy breaches, asked managers to review access permissions on remaining documents, and introduced mandatory privacy awareness training for all staff in March.

The federal privacy commissioner’s office told the CSE In April that the steps taken were reasonable and that no further action was required, Sullivan said.

Valerie Lawton, a spokeswoman for the commissioner’s office, confirmed that it was aware of the incident, but added the Privacy Act prevented her from saying more.

Bossenmaier sent the March 20 email to staff shortly before a brief account of the breach was tabled in Parliament as part of a broader written answer to a formal question about federal data lapses from New Democrat MP Charlie Angus.

Sullivan said the timing of Bossenmaier’s message “was directly related to completing the process of notifying the five impacted individuals.”

In her note, Bossenmaier urged staff to review the new privacy protocol, take the mandatory training, exercise care when assigning access permissions to documents, remain alert to any “serious anomalies” in information management, and immediately report any problems.

“We all have a role to play in safeguarding information, and I am reminding you to apply it seriously to all information held by CSE.”

Get local stories you won't find anywhere else right to your inbox.
Sign up here

Just Posted

Alberta Premier Jason Kenney speaks during a news conference in Edmonton on Feb. 24, 2020. It’s budget day in the province, and Kenney’s United Conservative government is promising more help in the fight against COVID, but more red ink on the bottom line. THE CANADIAN PRESS/Jason Franson
Alberta’s budget promises more help for COVID-19 with a hard deficit

EDMONTON — Alberta’s COVID-19-era budget made a hard landing Thursday with an… Continue reading

The expansion of the Red Deer Regional Hospital Centre has been discussed for over a decade. (File photo by Advocate staff)
Red Deer hospital expansion gets about $6 million in 2021 provincial budget

According to the government’s three-year plan, the project will get $59 million by 2024.

The Town of Sylvan Lake has launched a new contest to attract a new business. (File photo by Advocate staff)
Sylvan Lake offering rent-free storefront space to lure new businesses

Winning business proposal will get a storefront space rent-free for a year

Red Deer Rebels forward Josh Tarzwell is hoping to pick up where he left off last season as the 2020-21 WHL season kicks off Friday in Red Deer against the Medicine Hat Tigers. (Photo by BYRON HACKETT/Advocate Staff)
Rebels set to host Tigers in WHL season opener

24-game WHL Alberta only season kicks off night Friday at the Centrium

Alberta reported an additional 399 cases of COVID-19 Thursday, on 9,217 tests, for a test positivity rate of 4.3 per cent. (Image courtesy CDC)
Red Deer down to 562 active COVID-19 cases

8 new COVID-19 deaths, 399 additional COVID-19 cases

An arrest by Red Deer RCMP is facing online scrutiny. No charges have been laid and the incident is still under investigation. (Screenshot of YouTube video)
Red Deer RCMP investigating violent arrest caught on video

Police say officer ‘acted within the scope of his duties’

No-size-fits-all residence approach a reality for Canadian Hockey League teams

No-size-fits-all residence approach a reality for Canadian Hockey League teams

FILE - New York Rangers' Henrik Lundqvist reacts after a save during the third period of an NHL hockey game against the Philadelphia Flyers in New York, in this Sunday, March 1, 2020, file photo. The Flyers defeated the Rangers 5-3. Star goalie Henrik Lundqvist will sit out the upcoming NHL season because of a heart condition, announcing the news a little more than two months after joining the Washington Capitals. Lundqvist posted a written statement and a videotaped one on social media Thursday, Dec. 17, 2020, saying it was a "pretty tough and emotional day." The 38-year-old from Sweden was bought out by the New York Rangers after 15 seasons and signed a $1.5 million, one-year deal with Washington in October. (AP Photo/Seth Wenig, File)
Lundqvist back on ice, ‘months’ away from deciding future

Lundqvist back on ice, ‘months’ away from deciding future

Kiiwetinoong MPP Sol Mamakwa holds up water collected from Neskantaga First Nation, where residents were evacuated over tainted water in October, during a rally at Queen's Park in Toronto on Friday, Nov. 6, 2020. THE CANADIAN PRESS/Carlos Osorio
Feds didn’t supply enough resources to end water advisories on First Nations: auditor

Feds didn’t supply enough resources to end water advisories on First Nations: auditor

A dose of COVID-19 vaccine is prepared at a vaccination clinic in Montreal's Olympic Stadium on Tuesday, Feb. 23, 2021. THE CANADIAN PRESS/Paul Chiasson
Quebec starts COVID-19 vaccination bookings for seniors; those in Ontario must wait

Quebec starts COVID-19 vaccination bookings for seniors; those in Ontario must wait

The corporate logo of Pembina Pipeline Corp. (TSX:PPL) is shown. Calgary-based Pembina Pipeline Corp. says it is "doing what is right for the country and fellow Canadians" by shipping unit trains full to propane to Quebec. THE CANADIAN PRESS/HO
Pembina Pipeline posts $1.2 billion loss on petrochemical, LNG project impairments

CALGARY — Pembina Pipeline Corp. is reporting a $1.2 billion net fourth-quarter… Continue reading

Rode
Red Deer College esports league off to a good start

Red Deer College Kings hockey veteran Jacob Wozney has been involved in… Continue reading

This combination photo shows the cover of "Later," left, and author Stephen King. Readers may know him best for “Carrie,” “The Shining” and other bestsellers commonly identified as “horror,” but King has long had an affinity for other kinds of narratives, from science fiction and prison drama to the Boston Red Sox. (Hard Case Crime via AP, left, and AP)
Stephen King talks about crime, creativity and new novel

Stephen King talks about crime, creativity and new novel

A Loblaws store is seen in Montreal on March 9, 2015. THE CANADIAN PRESS/Ryan Remiorz
Loblaw’s discount stores on upswing after ‘flight to conventional’ stores: president

Loblaw’s discount stores on upswing after ‘flight to conventional’ stores: president

Most Read