Communications Security Establishment Act ( S.C. 2019, c. 13, s. 76)

31 Activities and classes of activities that an authorization issued under subsection 29(1) or 30(1) may authorize the Establishment to carry out may include any of the following:

• (a) gaining access to a portion of the global information infrastructure;
• (b) installing, maintaining, copying, distributing, searching, modifying, disrupting, deleting or intercepting anything on or through the global information infrastructure;
• (c) doing anything that is reasonably necessary to maintain the covert nature of the activity; and
• (d) carrying out any other activity that is reasonable in the circumstances and reasonably necessary in aid of any other activity, or class of activities, authorized by the authorization.

Marginal note: Prohibited conduct

• 32 (1) In carrying out any activity under an authorization issued under subsection 29(1) or 30(1), the Establishment must not
  • (a) cause, intentionally or by criminal negligence, death or bodily harm to an individual; or
  • (b) wilfully attempt in any manner to obstruct, pervert or defeat the course of justice or democracy.

  Procedure

  Marginal note: Applications for authorizations

  • 33 (1) The Minister may issue an authorization under subsection 26(1), 27(1) or (2), 29(1) or 30(1) only on the written application of the Chief.
  • Marginal note: Contents of application (2) The application must set out the facts that would allow the Minister to conclude that there are reasonable grounds to believe that the authorization is necessary and that the conditions for issuing it are met.
  • Marginal note: Written request of infrastructure owner or operator (3) If the application is for an authorization to be issued under subsection 27(2), the application must include the written request of the owner or operator of the information infrastructure to the Establishment to carry out the activity that would be authorized.
  • Marginal note: Minister of Foreign Affairs’ request or consent (4) If the application is for an authorization to be issued under subsection 30(1), the application must include the request or consent referred to in subsection 30(2) if it is in writing.

  Marginal note: Conditions for authorizations

  • 34 (1) The Minister may issue an authorization under subsection 26(1), 27(1) or (2), 29(1) or 30(1) only if he or she concludes that there are reasonable grounds to believe that any activity that would be authorized by it is reasonable and proportionate, having regard to the nature of the objective to be achieved and the nature of the activities.
  • Marginal note: Conditions for authorizations — foreign intelligence (2) The Minister may issue an authorization under subsection 26(1) only if he or she concludes that there are reasonable grounds to believe — in addition to the matters referred to in subsection (1) — that
    • (a) any information acquired under the authorization could not reasonably be acquired by other means and will be retained for no longer than is reasonably necessary;
    • (b) any unselected information acquired under the authorization could not reasonably be acquired by other means, in the case of an authorization that authorizes the acquisition of unselected information; and
    • (c) the measures referred to in section 24 will ensure that information acquired under the authorization that is identified as relating to a Canadian or a person in Canada will be used, analysed or retained only if the information is essential to international affairs, defence or security.
    • (a) any information acquired under the authorization will be retained for no longer than is reasonably necessary;
    • (b) the consent of all persons whose information may be acquired could not reasonably be obtained, in the case of an authorization to be issued under subsection 27(1);
    • (c) any information acquired under the authorization is necessary to identify, isolate, prevent or mitigate harm to
      • (i) federal institutions’ electronic information or information infrastructures, in the case of an authorization to be issued under subsection 27(1), or
      • (ii) electronic information or information infrastructures designated under subsection 21(1) as being of importance to the Government of Canada, in the case of an authorization to be issued under subsection 27(2); and
      • (i) federal institutions’ electronic information or information infrastructures, in the case of an authorization to be issued under subsection 27(1), or
      • (ii) electronic information or information infrastructures designated under subsection 21(1) as being of importance to the Government of Canada, in the case of an authorization to be issued under subsection 27(2).