Canada's electronic spy agency facing a staffing crisis
CSE not immune to shortage of cybersecurity experts, chief acknowledges
The Communications Security Establishment (CSE), one of the federal agencies tasked with countering foreign interference, is experiencing a "major staffing crisis," a former CSE spy told Radio-Canada/CBC.
The CSE intercepts and decodes communications of foreign targets that seek to harm Canada. It is also responsible for protecting the federal government's computer network and advising critical infrastructure operators, such as banks and hospitals, on how to protect themselves against cyberattacks.
In a rare interview, the CSE's chief, Caroline Xavier, did not deny that there is a crisis, but said the shortage of cybersecurity experts is a global problem.
"Talk to any other CEO that manages a technical organization, they will all tell you we're competing for top talent," she said. "So it is potentially a national crisis, but it's not a crisis only for CSE".
Some superstars have left.- Former CSE employee
Recent revelations regarding India and China have given Canadians a glimpse of the threats facing this country.
The Indian government is suspected of having ordered the assassination of a Sikh activist on Canadian soil, while the Chinese government is accused of having led intimidation and disinformation campaigns to try to influence the results of the last federal elections.
It's the loss within the CSE of highly skilled technical experts capable of infiltrating enemy networks, decrypting intelligence and thwarting threats to Canada that is raising concerns.
Radio-Canada/CBC interviewed half a dozen former employees who have left the agency in recent years. We have agreed to withhold their identities due to the nature of their work.
Wanted: Experts capable of infiltrating enemy networks
"Some superstars have left," said an ex-CSE spy.
While several former employees agree that the agency still has high-calibre talent, "We can't say there isn't a problem," said one of them.
"I saw a lot of my colleagues leave before I left and I saw a lot of them leave after me," said another former agent.
"I mean, no one is really irreplaceable, but it felt like some of the guys were really irreplaceable. I assume that's a problem."
The CSE depends on computer and cryptography experts to gather and analyze foreign signals intelligence such as telephone calls and computer communications, as well as signals from satellites, radars and other wave-emitting devices.
When technical specialists leave the CSE, they often take with them unique expertise in detecting an array of threats, according to a former spy.
"They'll specialize in one specific type of technical attack to get the information. When we lose them, we're losing people that are very important to the type of operational program that gathers intelligence on all the different targets — counterterrorism, specific countries, election interference — because we use that technique to get intelligence on all those topics," he said.
The departure of these experts also harms Canada's ability to defend itself against some cyberattacks, according to the former spy.
"Foreign intelligence heavily feeds into our cyberdefence program. If you're losing that intelligence, that also means you're losing visibility into what these cyberthreat actors are doing," he explained. "And if you don't see what they're doing through foreign intelligence, you're probably never going to catch it on the network defence side."
"Of course it always hurts, every time we lose an expert, we will admit it," said Xavier. "We work hard to ensure that there is not just one expert in one field. That's why we work as a team."
The CSE's chief insists she still has the necessary means to accomplish her mission.
"I have a population of employees who work on government priorities, which include foreign interference," she said.
Xavier said she can also count on the "Five Eyes," an intelligence exchange network made up of the United States, Great Britain, Australia, New Zealand and Canada.
Overall, the CSE workforce has continued to increase in recent years. It went from 2,900 full-time employees in March 2020 to 3,232 employees in March 2023, which indicates a good retention rate, according to the CSE.
But these numbers are misleading, according to ex-spies.
"If you analyzed the top talent level, it would be a different story," one said. "When you lose an employee who is in the top 10 per cent of your cohort, it hurts a lot."
Xavier would not say how many technical positions need to be filled, however job offers published by the CSE reveal vacancies in key sectors.
For instance, the agency is looking to recruit computer network exploitation analysts.
According to the ad, their tasks include "gaining access to networks of foreign targets" and "conducting operations that degrade, disrupt ... or interfere with threats to Canada."
WATCH | The CSE chief talks about recruiting challenges:
The pandemic effect
It was the pandemic that further amplified competition from the private sector in the field of cybersecurity, former agents explained.
For example, when an American company previously attempted to recruit CSE experts, the need for them to obtain work permits and to relocate their families were deterrent factors.
With the pandemic, it suddenly became possible for a cybersecurity specialist to work for a foreign company without leaving the comfort of home, while earning more money.
Career advancement, the ability to work from home and higher salaries in the private sector were among the reasons for leaving given by the ex-spies who spoke with Radio-Canada/CBC.
Except for executive positions, the CSE has its own compensation system, separate from the Public Service of Canada, that allows for higher pay.
However, the salary scale for technical positions starts around $63,000 and tops out at a little over $168,000.
"You can easily double or triple your salary in the private sector, especially with the Magnificent Seven," said a former agent, referring to the nickname given to seven American multinationals — Nvidia, Tesla, Meta, Apple, Amazon, Microsoft and Alphabet (Google) — for their performance on the stock market.
Some former spies warn there are also downsides to working in the private sector.
The lack of job security or pension plan should not be overlooked, they say. In addition, deadlines are often non-negotiable, leading to long hours and a much more difficult work-life balance.
Xavier recognizes that she can't compete with private sector pay. But what the CSE can offer, she said, is a good working environment and challenges that can be found nowhere else.
"There are things that we are capable of doing here that would be illegal in the private sector," she said, explaining that there are operations and tools specific to the agency that are authorized under its mandate to protect Canada and its interests.
Xavier said the CSE has also drawn lessons from the pandemic. It now allows its employees to work partly from home.
But the most sensitive tasks must still be performed from the CSE's secure headquarters in Ottawa.
In order to attract talent elsewhere in the country, the CSE is also considering opening secure offices in other urban centres, but Xavier won't say where.
It's a dilemma for the agency, said an ex-employee. "There is still an operational need to protect 40 million Canadians. Some people tend to forget that you can't do that from your basement."
'You don't replace a Sidney Crosby'
The CSE is currently conducting a major recruitment campaign.
This fall alone, the agency is participating in at least 33 recruiting activities including job fairs, according to its website.
But it will take years for a new recruit to reach the level of expertise of top technical specialists, warns a former spy. "It's something you learn by doing. There are no spy schools".
"You don't replace a Sidney Crosby with three fourth-line players," said another ex-employee.
However, Xavier said her recruitment efforts are already bearing fruit.
"There are people coming in who are showing those who have been here for a long time specializations, techniques that even they have never seen," she said.
And "it's not just the human who helps us do our work," she added, referring to artificial intelligence.
"This year, our automated defences protected the Government of Canada from 2.3 trillion malicious actions, an average of 6.3 billion a day," according to the CSE's most recent annual report.
But Xavier recognizes that the more new talent she can hire, the more "it will help my cause."
Up to a year or longer for security clearance
However, the CSE's hiring process does not allow for rapid mass recruitment.
Nearly all CSE positions require an "enhanced top secret" clearance.
Once a candidate has been selected, the security screening itself can take anywhere from six to 12 months or even longer, according to the CSE's website.
CSE has a certain fear of repeating an Edward Snowden story.- Former CSE employee
It involves an in-person interview, credit and criminal checks, a psychological assessment, a polygraph test and a background investigation covering at least the last 10 years of the candidate's life including residence, employment, school, international travel and more.
"CSE has a certain fear of repeating an Edward Snowden story," said an ex-spy, referring to the former employee of the United States National Security Agency who revealed many global surveillance programs.
All former CSE employees with whom Radio-Canada/CBC spoke agreed that a rigorous security screening is necessary to ensure, among other things, that the candidate is loyal to Canada and not a spy operating for a foreign country.
But many believe that certain delays can be blamed on bureaucratic slowness.
Very promising candidates have gotten away from the CSE, said former employees.
"They're waiting and waiting to get an answer, or they're waiting and waiting for the next step ... when you've got a private sector that can take somebody in a third of the time, and perhaps offer a better salary," said one of them.
Xavier said additional human resources and security personnel have been hired in order to speed up the hiring process while maintaining its rigour.
"The problem is real, but can it be fixed?" pondered one ex-spy regarding the CSE's retention and recruitment challenges.
"How do you counter nation states like China that have whole armies of cyber experts trained to attack critical infrastructure?" asked another former CSE agent.
"That's the scale of the threats that Canada is facing."
- Get the news you need without restrictions. Download our free CBC News App.
ABOUT THE AUTHOR
