Canada’s digital spying agency, the Communications Security Establishment (CSE), has been taking the lead on using a service allowing it to track up to 15 million uploads and downloads of files everyday, according to a story broken by the CBC and The Intercept, a U.S.-based news site.
Formerly dubbed the Communications Security Establishment Canada (CSEC), the CSE is a member of the Five Eyes, the name given to a partnership between Canada, the U.S., the U.K., New Zealand, and Australia. While Canada’s spy agency has typically been considered less senior, it appears Canada has been leading this particular project, nicknamed “Levitation.”
The information came out of a PowerPoint document from Edward Snowden, former employee-turned-whistleblower at the National Security Agency (NSA) in the U.S. First revealed to journalists Ryan Gallagher and Glenn Greenwald, the pair collaborated on the story with the CBC. Greenwald has worked closely with Snowden in the past, first helping him to reveal information on the NSA by publishing a story in The Guardian in June 2013.
The PowerPoint slides were apparently part of a presentation given by a CSE analyst, where it showed how the agency is using its partners’ databases to track traffic online. More specifically, the presentation showed how CSE analysts were looking at records of up to 15 million uploads and downloads everyday on file-sharing sites for videos, photographs, music, and so on. However, while the CSE was using the Levitation tool to look for terrorist activity, it was also pulling up information on millions of people worldwide, including Canadian consumers with no connections to terrorist groups.
“Every single thing that you do — in this case uploading/downloading files to these sites — that act is being archived, collected and analyzed,” said Ron Deibert, director of the Citizen Lab, in an interview with the CBC. He likened the Levitation tool to a “giant X-ray machine over all our digital lives.”
The document said the CSE was looking at data from 102 websites that provide free file uploads, though it only named three – Sendspace, Rapidshare, and Megaupload, the last of which is no longer in service. However, based on the document, it’s not clear how much information the Five Eyes typically access on uploaded files themselves, or whether these websites know the Five Eyes have access. It’s also not clear whether telecommunications companies or Internet service providers are involved in providing access to the data, though the document does point to “special sources.”
According to the document, analysts find 350 “interesting download events” every month, which is less than 0.0001 per cent of all of the traffic that gets collected. Using Levitation, analysts are typically searching for extremist propaganda and training resources, though the analyst who made the PowerPoint document referenced finding out that people were downloading episodes of Glee, an American TV series.
While that implies there’s more traffic than analysts know what to do with, some privacy experts have raised concerns about what the CSE’s intrusiveness in tracking consumer activity, what it might be doing with all of the information it has been collecting, and whether the agency has been tracking targets unrelated to its mandate of searching for foreign threats and terrorists.
Correction: A previous version of this post misspelled the “Levitation” tool as “Leviathan.” We regret the error.