CSIS ‘Otherwise Illegal Acts’ Powers Need a Public Compliance Ledger

Extraordinary national-security powers require visible compliance receipts, not just reassurances.

Canada’s spy service has powers most government agencies should never touch: in limited circumstances, designated CSIS employees can commit or direct acts that would otherwise be offences under Canadian law while carrying out intelligence work. That is not a talking point from critics. It is the National Security and Intelligence Review Agency’s own description of the Justification Framework created under the CSIS Act.

NSIRA’s October 1 backgrounder makes an important distinction. The watchdog found CSIS complied with statutory limits on prohibited conduct in all reviewed operations. That matters, and no one should pretend NSIRA found torture, bodily harm, obstruction of justice or other barred conduct. National security work is serious, and Canada does need intelligence tools against real threats.

But the same review also found possible non-compliance with other CSIS Act requirements: designation, authorization, written reporting and notification to NSIRA. It flagged weak documentation of reasonableness and proportionality. It also said annual reports for 2019 through 2022 were not published or made available when required. In plain English: even when the outer red lines were respected, the paperwork and accountability chain around extraordinary powers was not good enough.

That is exactly where Parliament should be least tolerant of vagueness. If an agency can authorize conduct that would otherwise be illegal, the public cannot be asked to rely on “trust us” compliance. Every use should have a documented threat basis, legal authority, proportionality analysis, authorization trail, after-action report and review notification. If the facts are sensitive, redact operational details. Do not redact the existence of the ledger.

CSIS’s response is mixed. The service agreed with NSIRA’s recommendation to improve internal guidance, oversight and quality assurance. It agreed with the finding that CSIS complied with the limits on use of the framework. It partially agreed on documentation and written-report issues, agreed on one authorization-related finding, and disagreed on designation and notification findings. That dispute makes a public compliance ledger more necessary, not less.

A conservative accountability standard is simple: give security agencies the lawful tools they need, then force government to prove those tools are controlled. Secret powers need more audit discipline than ordinary programs, not less. Canadians do not need operational secrets; they need annual numbers, publication dates, authorization controls, training fixes, compliance findings, NSIRA-notification counts and explanations for lawful redactions.

The Liberal government should not wait for the next watchdog report to discover whether the system improved. Public Safety, CSIS and Parliament should publish a Justification Framework compliance ledger now: how many authorizations, which reports were late or missing, what training changed, what internal compliance reviews found, and when the 2019–2022 public reporting gap was fixed.

If Ottawa wants Canadians to accept exceptional national-security powers, it must show exceptional compliance receipts.