Panel Presentation at the International Intelligence Review Agencies Conference, 2008

Panel Presentation by the Communications Security Establishment Commissioner,
The Honourable Charles D. Gonthier, C.C., Q.C.
for the International Intelligence Review Agencies Conference
Auckland, New Zealand, 7 October 2008

Thank you Mrs. Taylor for your kind introduction  — and good morning ladies and gentlemen. I am pleased to have this opportunity to share my thoughts on how agencies' trust in reviewers, as well as reviewers' knowledge of agency work, can be built and maintained while safeguarding the reviewers' independence.

As Commissioner of Canada's Communications Security Establishment, I have a permanent staff of eight supplemented by a number of subject-matter experts who review CSE's activities to assess whether they are in compliance with the law. In practice, my office reviews CSE's activities through a series of projects carried out each year.

As I see it, an intelligence agency reviewer has to be concerned not only with building and maintaining the trust of the agency being reviewed, but also of the broader public on whose behalf the review is being carried out. The two are, of course, directly related, and hinge upon individuals being well informed and conducting themselves – and being seen to conduct themselves –  professionally, with integrity, and with a fundamental respect for the rule of law and democratic values.

CSE has to operate largely in secrecy. Therefore, the role of my office is to represent the public interest in accountability – but in a way that does not compromise the important work that CSE does. I believe strongly that mutual respect and trust between the reviewer and the agency being reviewed provides the basis for broader public trust. Moreover, such trust between the reviewer and the reviewed is predicated on maintaining the independence of both parties, even as they strive to serve a common public purpose. As I see it, trust and independence are complementary and mutually reinforcing concepts. 

Let me turn now to what I see as some of the most important principles, as well as ways and means that my office uses to help ensure ongoing trust, as well as its real and perceived independence. I will deal with these under four headings:

  1. the need for clear rules of the game;
  2. the importance of fundamental values;
  3. the need for a sound, consistent and transparent review process; and
  4. the importance of people.

Clear Rules of the Game

It is of fundamental importance, in my view, that the mandates and authorities of both the reviewer and the agency being reviewed be clearly articulated. In the case of CSE and my office, the law sets out the roles, responsibilities and duties of both parties, and thus provides the foundation upon which the review relationship has been built.

For example, by setting out clearly that the purpose of the Commissioner's review activities is to assess compliance with the law, and by establishing the Commissioner's right of access to CSE's premises, information and people, the enabling legislation ensures that these kinds of matters will not become bones of contention.

Further, the legislated requirement for the Commissioner to be a retired or supernumerary judge of a superior court adds considerably to the institutional independence of the review function. So too does the provision that the Commissioner may hire such counsel, advisers and assistants as he or she considers necessary for carrying out the duties of the office.

As well as institutional independence, however, it is necessary to ensure operational independence. This means that clear rules of the game need to extend also to the day-to-day processes and practices of review. I will return to this subject a little later, to describe some of the ways that my office works to build trust and ensure its operational independence.

But first I would like to discuss briefly the important role that I believe a respect for fundamental values plays in effective review relationships.

Values

Individual and organizational respect for fundamental democratic values within CSE is critically important, and I will return to that in due course. My primary focus here, though, is on the values that I and my office must bring to bear in exercising my review responsibilities.

I believe the essential starting point in this regard is the clear recognition that the role of my office complements – rather than opposes or restricts – the vital role CSE plays in helping to ensure the security of the people in Canada. We must see ourselves as strengthening the culture of compliance and respect for privacy in CSE and thus being on the same side in serving the Canadian public. By doing our job well – and that means in a way that builds trust and maintains our independence – we will in fact contribute to the efficiency and effectiveness of CSE.

A practical implication of this recognition is that we must be open-minded and professional in our work. In particular, we approach review, first and foremost, as an engagement of being able to provide assurance about the activities of CSE to the Minister of National Defence, who is responsible for that organisation.  Ours is not an exercise in turning over every rock and peering into every corner with the specific intention of finding fault.

My office has consistently recognized prevention as an important aspect of its role. As such, most of our recommendations address shortcomings in CSE's policies, procedures and practices that, if not corrected, increase the risk that unlawful activity might occur. I am, in fact, happy when I can report at the end of a review that we have found no instances of lack of compliance with the law.  There may be, and have been, however, instances where disagreements arise over a particular issue or where I am not satisfied with CSE's explanation or information and therefore direct my staff to pursue the issue.   

Process

CSE's trust in my office depends significantly on the demonstrable quality of our review work. As a result, we have placed considerable emphasis on developing, documenting and implementing sound methodologies, based on accepted standards of review and informed by years of practical experience.

We have developed operational policies and procedures that, among other things, provides guidance to staff and contractors in carrying out reviews, ensures a large measure of transparency and consistency in our work when seen from CSE's perspective, and provides a basis for assessing and improving our own performance in implementing our mandate.

Our review process and practice is generally characterized by regular and open two-way communications at all stages. I believe such communications, and the following examples of elements of our review process and practice, contribute to building CSE's trust in our knowledge and work as well as to maintaining our independence.

  1. My office's activities are guided by a regularly updated three-year work plan that provides a focal point in the relationship between my office and CSE. We consult CSE about the review components of the plan to ensure that management not only knows what is coming up, but has a chance to contribute to it. Such consultation helps ensure, for example, that our reviews and CSE's own internal reviews and audits are appropriately coordinated; that we are fully aware of areas in CSE that may be undergoing significant reorganization or restructuring; and that there is appropriate balance between the exercise of my review mandate and CSE's operational requirements as mandated by the government.  We are also careful to ensure that consultation with CSE does not lead to, or even suggest, that the responsibility for review is shared with CSE which would risk impeding the independence of my office.
  2. Within the context of a specific review, and before detailed work begins, CSE has an opportunity to comment on the terms of reference that we propose for the review – including such matters as the scope, objectives, criteria, methodology and timeframes.
  3. As we carry out the fieldwork for a review, the potential findings, conclusions and recommendations begin to evolve. We discuss these with CSE on an ongoing basis as the review progresses. This helps ensure that they are aware of our emerging views and have an opportunity to provide input before being asked formally to review a draft report for its factual accuracy.  CSE often begins to address these issues before the review report is issued, provided, of course that they agree, which they do in most instances.  As a result, by the time my report reaches the Minister, most matters have been dealt with. 
  4. The recommendations that I make are not binding. Were they otherwise, it would risk usurping the role of management at CSE. For similar reasons, I avoid making recommendations that are overly prescriptive in suggesting how any shortcomings that have been identified should be addressed.
    My office engages with CSE to monitor the status of recommendations, which I see as an important indicator of the impact of our review activity. And in this regard I am encouraged by CSE's acceptance of the vast majority of the recommendations my office has made. I believe the fact that a large proportion of them have been accepted and have been either fully implemented or are at various stages of being implemented, is one indicator of CSE's regard for the work of my office.
  5. I mentioned earlier that legislation provides the Commissioner with the right of access to all premises, records, documents (with the exception of Cabinet confidences) and people required for the performance of the Commissioner's duties. With this degree of access, however, comes a corresponding obligation for my office to ensure that its requests for access are indeed germane to the fulfillment of review responsibilities and that it fully respects the security of the information that it obtains from CSE.

Overall, in our policies, procedures and practice, we strive to project a well-informed, professional and competent approach to all of our review work. Much of our success in this regard depends on people.

People

The role of the individual in doing the right thing is of fundamental importance when it comes to trust and independence. This is certainly true with respect to leadership of the review agency as well as the organization being reviewed – and it is particularly true with respect to those who are on the "front line".

In the case of the Communications Security Establishment, the people who are doing the work of collecting intelligence must clearly have high technical competence. But they must have more than that – they must also have a deep-seated respect for the rule of law and democratic values, which includes a reasonable expectation of privacy for Canadians. They must wrestle, on a daily basis, with the difficulties inherent in collecting information that helps to protect the security of Canada and Canadians, but in ways that also safeguard privacy.

What we look for in our reviews is evidence of an organizational culture within CSE – including training, policies and procedures – that promotes and monitors respect for the law and democratic values, and thereby supports its front-line people in their challenging but vitally important work. We also look at established management practices, such as policy development and effective records management, which are necessary elements for any organisation's ability to account as accurately and as effectively as possible for its activities and decisions.

In the case of my staff, it is important that the individual reviewers who are in day-to-day contact with CSE have the trust and respect of CSE officials for their knowledge – of CSE as well as of review – for their integrity, and for their professionalism. In our reviewers and review teams, we consistently promote:

Most of my staff have a security intelligence background and hone their review skills in a variety of ways, including mentoring by more experienced reviewers, drawing guidance from our operational policies and procedures and undertaking formal training as required. In addition, I can and do contract for the services of subject-matter experts as required – including experts in review as well as technical experts.

Over the years we have developed a relationship with CSE whereby our staff have the opportunity to participate in their basic training sessions so that they can become more knowledgeable about CSE's activities and challenges. At the same time, CSE's training program includes presentations by my office to increase their awareness of our review mandate and practices.

Conclusion

In the final analysis, the proof of the pudding is in the eating. There needs to be an active, credible and ongoing review program, producing reports that are of value to their target audiences (at the agency, executive and parliamentary levels) by providing assurance to the Minister, identifying problems, and pointing to opportunities for taking corrective action when that is necessary.

I do not believe that any individual or organization really enjoys having their activities reviewed. It has long been recognized that some tension is inherent in a review relationship and that, inevitably, some "glitches" are bound to occur. The important thing is that such glitches remain inadvertent exceptions rather than becoming systemic and poisoning the entire relationship.

To this end, I have periodic contact with the head of CSE, and my managers meet CSE managers regularly to update progress and deal with any issues as they come up.

Another element is an annual "roundtable" for discussions between my staff and CSE officials about the working relationship. The purpose is to identify what works, what is not working as well and how the relationship can be maintained and improved.

And finally, over two years ago, my staff initiated a Review Agencies Forum, which brings together the staffs of several Canadian review agencies twice a year to discuss emerging issues and challenges, and to identify best practices in review – much as we are doing here in New Zealand at a broader level. 

The bottom line is that building and maintaining trust in us as reviewers, and safeguarding our independence, requires constant attention, management and reconciliation of interests at all levels.

I thank you for your attention and look forward to a stimulating discussion.

Date modified: