Operational Standard for the Security of Information Act

March 17, 2003

On December 24, 2001, amendments to the Official Secrets Act, as adopted by Parliament became law. The Act was renamed the Security of Information Act (SOIA) . The revised Act, among other things, modernizes the espionage provisions and introduces new concepts, such as "special operational information" and "persons permanently bound to secrecy."

In general terms, "special operational information," which is defined in section 8 of the Act, describes the most operationally sensitive government information, which the government is taking measures to safeguard. The unauthorized disclosure of such information would cause obvious damage to the Government of Canada.

The following are examples of this type of information:

• Past and current confidential sources of information, intelligence, or assistance to the Government of Canada.
• Places, persons, groups, or entities who were, are, or are intended to be targets of covert collection efforts by government.
• The identity of any person engaged in such covert collection activities.
• Military operational plans for armed conflicts.
• The means used by government to protect information, including encryption and any vulnerabilities.
• Similar information to the above that relates to or is received from foreign entities or terrorist groups.

Another new concept is that of "persons permanently bound to secrecy." These are persons held to a higher level of accountability for certain unauthorized disclosures. While all persons may be subject to the provisions of section 4 of the Security of Information Act (dealing with unauthorized disclosure generally), there are now specific provisions dealing with the unauthorized disclosure of "special operational information" by "persons permanently bound to secrecy."

Unauthorized disclosure of this type of information by these persons will be subject to sanction

1. whether the information is true or not;
2. whenever the information was obtained by the persons, e.g. before being designated or after having left the position that triggered the persons to be "permanently bound to secrecy"; and
3. however the persons obtained the information.

The above applies to such persons even after they have changed positions, left government service, or finished a contract.

Persons may become part of this special regime in two ways:

1. Automatically: as current or former members or employees (including former members or employees as of December 24, 2001) of particular departments set out in the schedule to the Act (such as the Canadian Security Intelligence Service, the Communications Security Establishment, and certain branches of the Royal Canadian Mounted Police); or
2. Selectively: if a deputy head is of the opinion that, by reason of a person's office, position, duties, contract or arrangement, the person had, has, or will have authorized access to "special operational information" and it is in the interest of national security to permanently bind that person to secrecy, this person may be notified that he or she has been so designated. Designation should not be the norm. It should generally only apply to those with an intimate knowledge of "special operational information."

A person need only be "permanently bound to secrecy" once during their lifetime, either through employment in a scheduled department or by designation.

The purpose of this operational standard is to provide administrative procedures for

1. departments that are listed in the schedule to the Act, (referred to as scheduled departments, see section 3 of this Standard); and
2. the designation by notice of employees in non-scheduled departments and of persons and government contractors in scheduled and non-scheduled departments. (See section 4 of this Standard.)

Departments shall consult with the Treasury Board of Canada Secretariat if there is a requirement to amend the schedule.

This standard addresses also selection criteria to help identify persons who may be designated by notice. In addition, the standard emphasizes the importance that security awareness and briefings act as a preventative measure to encourage persons to safeguard "special operational information."

The SOIA creates specific offences for "persons permanently bound to secrecy." However, all employees, members and government contractors have responsibilities to safeguard sensitive information under the Government Security Policy .

Subsection 10(1) of the Act provides that persons, who are neither members nor employees of scheduled departments, may be designated, by notice in writing, to the effect that they are "permanently bound to secrecy" because, by reason of their office, position, duties, contract or arrangement, the persons had, have, or will have authorized access to "special operational information" and it is in the interest of national security to permanently bind those persons to secrecy.

By way of guidance, designation will not normally be required for the vast majority of persons,

• who may be provided with some "special operational information" as part of the intelligence they receive from departments; and/or
• who are aware of particular aspects of such information; and/or
• who may from time to time give support and assistance to scheduled departments.

However, those persons who have intimate knowledge of "special operational information" should be designated. To assist the Departmental Security Officers in determining whether a person has intimate knowledge of "special operational information" and whether to recommend to the deputy head that a person should be designated, criteria and examples are provided. Circumstances may exist where the person would not necessarily hold a security clearance and nevertheless have intimate knowledge.

Even where the deputy head is not of the opinion that a person had, has, or will have intimate knowledge of "special operational information" to the extent expressed in the criteria and examples, the deputy head may consider it appropriate to designate the person in the interest of national security because of the particulars of the "special operational information" that the person had, has, or will have access to.

(a) Government contractors

The deputy head of Public Works and Government Services Canada (PWGSC) may designate contractors as "persons permanently bound to secrecy", when PWGSC is the contracting authority. Contractors operating under PWGSC contracts may be designated by another deputy head, where that deputy head has been authorized for this purpose by the Minister of Public Works and Government Services.

Contractors for whom PWGSC is not the contracting authority may be designated as "persons permanently bound to secrecy" by the deputy head of the department that awards the contract.

(b) Secondments, attachments, and working agreements with the Government of Canada

Persons seconded, attached, or under a working agreement with a department may be designated by the deputy head of the host department, unless they are already "persons permanently bound to secrecy." Departments should ensure that secondment, attachment, or working agreement documentation indicates that the person may need to be "permanently bound to secrecy."

After the designation process has been completed, the host department shall provide the person's home department with copies of the "Recommendation to Designate" form, the "Notice of Designation" form, the "Notice of Designation" letter and, if it has been used in the process, the "Affidavit of Service" form. This documentation should also be retained within the home department's personnel security screening file.

(c) Exceptional Cases

The Act at section 8(2)(e) deals with those exceptional cases where it may be difficult to identify a relevant deputy head. It is recommended, therefore, that the Departmental Security Officer contact their departmental Legal Services when presented with such cases.

1. "Persons permanently bound to secrecy" do not obtain a higher security clearance level by reason of their designation, nor do they gain unlimited, special access to safeguarded information. The need-to-know principle remains.
2. While it is preferable that a person has a security clearance, it is not a requirement for a person to be "permanently bound to secrecy."
3. The Departmental Security Officer may review the security screening file of a person who is to be "permanently bound to secrecy."
    
   The Canadian Security Intelligence Service shall, on behalf of the Government of Canada, record and store in the central registry of the Security Screening Branch, the information and documentation that it receives on all persons who are "persons permanently bound to secrecy."
    
4. When a person is "permanently bound to secrecy" under the Act, it is a good security practice, as it is the case of all persons holding a security clearance, to conduct update and exit interviews as part of the security screening cycle. The following apply therefore to both of those groups of persons.
5. Departmental Security Officers in scheduled and non-scheduled departments should ensure that subject interviews are conducted with all persons that have undergone a renewal of their security screening at the Level III (TOP SECRET) in accordance with section 10.5(b) of the Government Security Policy . As it is also the case for TOP SECRET renewals, where CONFIDENTIAL or SECRET level security screenings have been renewed, the " Security Screening Certificate and Briefing Form," TBS/SCT 330-47 , shall be completed as confirmation that the person has been reminded of their security obligations.
6. Departmental Security Officers, in the case of government contractors working on contracts issued by their department, are to ensure that subject interviews and the "Security Screening Certificate and Briefing Form," TBS/SCT 330-47 , are or have been completed.
7. When a person "permanently bound to secrecy" stops working with a department, he or she is required to undergo an exit interview conducted by a security official or an appropriate security exit procedure, both of which shall include a formal sign off of the form TBS/SCT 330-47 .
8. Individuals shall be reminded of their ongoing obligations under the Act and the consequences of any violations.

The Security Awareness Program is an ideal method through which the security responsibilities of persons, including those who have been "permanently bound to secrecy", should be reinforced. Scheduled departments and departments with designated employees must conduct a security awareness program as required under section 10.5 of the Government Security Policy . Security awareness messages may be disseminated by means of briefing sessions, videos, reading material, posters, and pop-up images on the computer screens.

Breaches of security that fall within the offence provisions of the Act are extremely serious. Departmental Security Officers shall ensure that the deputy head is advised of such incidents as soon as possible. Security access privileges to classified information and/or to secure premises may be suspended by the appropriate official until administrative, disciplinary and/or criminal processes have come to an end. The end result of these investigations or prosecutions may be taken into consideration by the appropriate official in determining whether to restore, or limit, the security access privileges or whether to revoke or alter the security clearance.

Departmental Security Officers may refer to section 10.15 of the Government Security Policy for examples of the reporting procedures. It should be noted that prosecutions involving "special operational information" shall not commence without the consent of the Attorney General of Canada.

Departments are to conduct damage assessments for breaches of security regarding "special operational information." They are to make recommendations based on the lessons learned from their investigation of those breaches. Such recommendations are to be shared with the Treasury Board of Canada Secretariat, so in turn the benefits may be shared with other departments, as per section 10.15 of the Government Security Policy .

The Treasury Board of Canada Secretariat, in consultation with other departments, shall review this standard after two years to assess its effectiveness.

• Government Security Policy , February 2002
• Policy on the Management of Government Information Holdings
• National Archives of Canada Act , 1987
• Privacy Act , 1983
• Security of Information Act , Dec. 2001

Enquiries concerning this standard should be directed to the Departmental Security Officer in each department. For interpretation of the standard, the Departmental Security Officer should contact the Security and Identity Management Division.

Arrangement

a formal or informal employment agreement between a department and one or more parties.

Attachment

includes personnel on temporary or permanent assignment to a department.

Department

any current or former department, division, branch, or office of the Government of Canada. (SOIA, subsection 8(1))

Designation by notice

the process whereby a person in a non-scheduled department, or a non-member or non-employee in a "scheduled department", is "permanently bound to secrecy" pursuant to subsection 10(1) of the SOIA.

Former members or employees

this includes individuals who were members or employees of the departments listed in the schedule prior to December 24, 2001.

Government contractor

a person who has entered into a contract or arrangement with the Government of Canada and includes an employee of the person, a subcontractor of the person, and an employee of the subcontractor. (SOIA, subsection 8(1))

Home department

the department to which the member or employee belongs.

Host department

the department to which a member or employee has been seconded, attached, or at which the member or employee is working under an agreement.

Member

a member of the Royal Canadian Mounted Police or of the Canadian Armed Forces.

Scheduled department

any current or former department, division, branch, or office of the Government of Canada that has or had a mandate that is primarily related to security and intelligence matters, which is listed in the schedule to the Act. (SOIA, section 9)

Special operational information

defined in section 8 of the SOIA, "means information that the Government of Canada is taking measures to safeguard that reveals, or from which may be inferred

1. the identity of a person, agency, group, body or entity that is or is intended to be, has been approached to be, or has offered or agreed to be, a confidential source of information, intelligence or assistance to the Government of Canada;
2. the nature or content of plans of the Government of Canada for military operations in respect of a potential, immediate or present armed conflict;
3. the means that the Government of Canada used, uses or intends to use, or is capable of using, to covertly collect or obtain, or to decipher, assess, analyze, process, handle, report, communicate or otherwise deal with information or intelligence, including any vulnerabilities or limitations of those means;
4. whether a place, person, agency, group, body or entity was, is or is intended to be the object of a covert investigation, or a covert collection of information or intelligence, by the Government of Canada;
5. the identity of any person who is, has been or is intended to be covertly engaged in an information- or intelligence-collection activity or program of the Government of Canada that is covert in nature;
6. the means that the Government of Canada used, uses or intends to use, or is capable of using, to protect or exploit any information or intelligence referred to in any of paragraphs (a) to (e), including, but not limited to, encryption and cryptographic systems, and any vulnerabilities or limitations of those means; or
7. information or intelligence similar in nature to information or intelligence referred to in any of paragraphs (a) to (f) that is in relation to, or received from, a foreign entity or terrorist group." (SOIA, subsection 8(1))

Text version: Diagram for SOIA Information gathering and Exchange

Data Flow Diagram for SOIA Information Gathering and Exchange - Display full size graphic

Legend: x - Completes details; y - Signs forms

Forms and Letter