National security experts say Canada should double-check classified documents amid U.S. breaches

As U.S. authorities ramp up investigations into classified documents in the homes of Donald Trump, Joe Biden and Mike Pence, Canadian government agencies are refusing to say if they are checking with former prime ministers, ministers or officials to see if they still have any classified documents in their possession.

On Wednesday, the FBI searched Biden's beach house in Rehoboth Beach, Del., for classified materials from his time as vice-president, coming up empty-handed.

Both Biden and Trump face special counsel investigations into their continued possession of the documents, while the U.S. National Archives has now asked former U.S. presidents and vice-presidents or their representatives going back to the Reagan era to recheck their personal records for any classified documents, according to reporting from the Associated Press.

National security experts told CBC News it would be prudent for officials in Ottawa to now reach out to former Canadian government ministers and senior officials to be doubly-sure they handed back any sensitive materials.

"Nothing is impossible — it is possible that former ministers or individuals keep information like this," said Michel Juneau-Katsuya, a former senior intelligence officer and manager at the Canadian Security Intelligence Service (CSIS).

"That's the reason why we have policy, that's the reason why we get people to sign documents and swear that they will neither reveal secrets or share documents ...  [but] definitely, we have lack of follow-up sometimes."

CBC News reached out to the Privy Council Office, Communications Security Establishment and Treasury Board Secretariat — three federal agencies with key roles in protecting classified information. None would say whether they were conducting any checks, nor would they comment on their level of confidence that no classified information was unaccounted for. 

In a statement Wednesday night, the Privy Council Office said: "In light of the breaches in the U.S., PCO is focusing on training and awareness to ensure employees are sensitized to their role and responsibilities in properly handling classified information and reporting leaks and breaches."

While not commenting directly on former prime ministers and ministers, the agency earlier said it had "a rigorous tracking system" for classified cabinet information, and processes for collecting those documents when governments and ministers left office after elections and cabinet shuffles.

The Treasury Board Secretariat, which oversees government-wide security policies, said individual government departments were responsible for protecting their own classified information, and it was up to ministers and their staff to ensure cabinet documents and official records "are left in the custody of appropriate authorities."

Library and Archives Canada — the equivalent of the U.S. National Archives — declined to comment for this story.

What is classified information?

Information that could cause harm to Canada's national interest can be classified as "confidential," "secret" or "top secret," based on how damaging its disclosure could be. 

Cabinet documents are "secret," while the "top secret" classification covers information about national security projects and potential hostilities against Canada, or information which could cause widespread loss of life or severe long-term damage to the economy.

To access classified information, ministers, public servants, military personnel and contractors must undergo background checks and be granted the appropriate security clearance.

Typically, hard copies are numbered and marked with the level of classification. They need to be signed out by the recipient, and returned to — or tracked down by — by each department's security officer. 

According to government rules for handling sensitive information, classified information shouldn't be emailed, but can be communicated by secure telephone or fax. Documents should be stored in approved security containers with a combination lock (such as a locked briefcase or filing cabinet), or on approved encrypted USB drives, which in turn are stored in locked containers.

System relies on trust

Retired general Roberto Mazzolin, a former director general of information management operations at the Canadian Armed Forces and Department of National Defence, who also served at the U.S. Cyber Command, says given Canada and the U.S. share very similar protocols for handling classified information, it "wouldn't hurt" to check for any outstanding documents in this country.

"Certainly, [with] those recent prime ministers that may still be politically active or active externally, it may not hurt to be able to go back and engage with these folks and ensure that they have an opportunity to look through their files and their activities, and see if there is anything," said Mazzolin, who is now chief technology strategist at RHEA Group.

But even within Canada's government, agencies have "slightly different" ways of handling classified documents, says Jessica Davis, a former intelligence analyst at Global Affairs Canada, FINTRAC and CSIS, who is now president of Insight Threat Intelligence.

"Some are stricter than others, some have much more codified practices than others," she said, adding that some will conduct spot checks of employees to ensure they aren't removing material from their workplaces.

"When it comes to higher levels of government — ministers or prime ministers — we are really trusting them to not be mishandling this kind of documentation," Davis said.

"To be completely frank, I'm not sure that we have systems in place to really prevent that kind of thing [missing documents] happening, because it does rely so much on trusting the individual."

Bernier's briefcase 'a wake-up call'

Canada tightened up some of its rules around handling, storing and disposing of classified information 15 years ago, after a high-profile breach involving then-Foreign Affairs Minister Maxime Bernier.

In 2008, he left secret briefing documents at his girlfriend Julie Couillard's house for seven weeks, during which time no one in the government realized the documents were unaccounted for. It later emerged he'd kept the documents in an unlocked briefcase while travelling to Europe for a NATO summit, in breach of government policy.

The incident prompted Bernier's resignation as a minister and a review of procedures around sensitive information at the department of foreign affairs, now called Global Affairs Canada, which subsequently improved its tracing of classified documents, and increased training for ministers and employees about their responsibilities for protecting sensitive information.

"In some ways, it's good that it happened, in the sense that it was a real wake-up call for a lot of people in Ottawa that these documents are not to be treated carelessly," said Andrew House, a partner at the law firm Fasken in Ottawa who previously served as chief of staff in the federal Public Safety Minister's office.

Breaches on the level of Bernier's, or even more serious, are extremely rare, but minor breaches "do happen regularly," House said.

A minor incident could involve a staffer leaving unclassified documents on a desk overnight in a locked room inside a guarded building, while someone taking information home without authorization would amount to a more serious breach, he said.

'Things do go missing'

Government agencies told CBC News they limited staff access to classified information on a need-to-know basis; that is, employees could only access it if it was necessary for their work.

While junior public servants and intelligence analysts would only access classified information inside of a secure facility, experts say there is more leeway for ministers and senior officials to take information home or on travel — and that comes with added risks.

"The problem is that things do go missing, things do get misplaced, and once you remove it from the secure environment, you don't necessarily have the same control over it," said Phil Gurski, a former analyst at CSIS and the Communications Security Establishment who now heads Borealis Threat and Risk Consulting.

"If you've got a minister or a higher official … who elects to remove material, then all bets are off."

Every breach, no matter how minor, is supposed to be reported, which would prompt an investigation into whether it was accidental, negligent or nefarious, and whether disciplinary action was necessary.

Juneau-Katsuya says there have been double standards in how discipline is administered, pointing to Bernier as an example: after resigning as a minister, he remained an MP for more than a decade, during which he was reappointed to cabinet.

"If [Bernier] would have been a regular federal employee, it would have been severe consequences: it would have been, probably, fired, if not jail  … but Mr. Bernier went on to stay with the government and have a very successful Conservative Party career."

The overclassification problem

In both Canada and the U.S., experts are urging a rethink of what information gets classified in the first place, pointing to both federal governments' tendency toward "overclassification."

"It's a very frequent experience to read a document labelled secret, and there's not a thing in it that isn't already in the public domain," House says of the situation in Canada. "The net effect is that there's far too much paper in Ottawa that is listed as 'classified' when it really ought not to be."

He said if Canadian government agencies do now conduct an audit for any unreturned classified materials, they should focus the most sensitive operational information — known as special operational information — rather than "who's got paper they shouldn't have."

"I'd like to think that no one is taking [special operational] information and moving it around or handling it in any fashion other than strictly by the book. In those instances, an audit — if there were a doubt about what had happened to a document — would absolutely be warranted," House said.

"In other cases, I think our efforts are probably best spent looking to the future and not the past."