OTTAWA — The Communications Security Establishment is getting money to fund research, giving academics the chance to work inside the secretive federal cyber agency—and creating potential ethical and practical conundrums.

The CSE reports to the defence minister; its original mandate was signals intelligence, including eavesdropping and codebreaking. With the advent of the internet, that has expanded to cyberwarfare.

In this month’s federal budget, the Liberal government said it would get $17.7 million over five years (and $5.5 million a year thereafter) to fund research chairs for people who “will split their time between peer-reviewed publishable research and classified research at CSE.” The budget separately promised CSE an annual funding boost that will reach $238.2 million by late this decade.

“Canadian academics are some of the leading researchers in important emerging and disruptive technologies, including quantum computing and artificial intelligence,” the document said. “This expertise can be leveraged to ensure Canada’s security and intelligence community stay[s] one step ahead of our adversaries.”

CSE declined to add further detail. “We’re excited about the new funding that was highlighted in [the] budget for CSE,” spokesperson Evan Koronewski said in an email. “Unfortunately, we’re not in a position to discuss the research-chair program for academics at this time.”

In addition to an applied-research component and a centre that looks for security exploits in hardware and software, the agency has a small in-house theoretical-research centre, the 11-year-old Tutte Institute for Mathematics and Computing. The institute has occasionally released open source software code for processing data and its members have published publicly; CSE’s roundup of that work stopped in 2019.

The institute’s head, Megan Dewar, gave a recorded talk last fall about its work. Answering a question about how interested the centre is in quantum computing, she spoke about how hard it is to build expertise in new areas.

“What’s the best distribution of the people we have? Do we try and shift over here and either hire people—or learn a whole bunch of new stuff to try and tackle this problem?” she said. If CSE gets interested in a new technology or approach, “I say, ‘OK, how many people are we going to hire?’ Because if I hire one researcher … they’re on an island trying to do research on their own, and that’s not fun.”

(The Tutte Institute has 12 full-time research staff, she said in that talk. Just in Ottawa, Carleton University’s School of Mathematics and Statistics has 39 professors; the math and stats department at the University of Ottawa has 42. Though they don’t work in an eight-year-old purpose-built headquarters whose cafeteria boasts a wood-burning pizza oven—a place whose construction project was dubbed “Camelot” by the government itself.)

Crossover between defence agencies and academia is more common in the United States, said Andrea Charron, director of the University of Manitoba’s Centre for Defence and Security Studies and a specialist in NORAD.

“I think it’s a function of the fact that they have more personnel on both the academic and public-service side,” she said. The U.S. is also more willing to bring students into secured and even classified environments for work terms and teach them “how important it is to be able to guard this kind of function, how to use it, manage it. And I think we are reluctant to do that.”

The money is “pocket change” for the government, but will change the agency’s relationship with Canadian universities in potentially difficult ways, said Christopher Parsons, a senior research associate at the University of Toronto’s Citizen Lab.

He specializes in data privacy and national security. That’s exactly the field where signals-intelligence agencies spend much of their time, though he said he has never done work for CSE. Its American equivalent, the National Security Agency (NSA), has deep relationships with schools such as Johns Hopkins and the University of Texas, Parsons said.

“The reason for this is to pursue talent, and to encourage faculty members and graduate students, and mathematicians in particular, to do all sorts of work that the NSA is going to need for its workforce. And if you walk over to the U.K., you see similar things.”

Both those countries are partners with Canada in the Five Eyes intelligence-sharing network that also includes Australia and New Zealand.

These relationships are in the background of fights over academic freedom and national security. And sometimes they lead to absurdities, Parsons said, such as with the NSA documents leaked by former contractor Edward Snowden, many of them widely published.

“The Snowden leaks are still classified,” he said. “So if you haul out a, what, eight-, nine-year-old document and you wave it in the face of someone at Johns Hopkins who has a top-secret clearance, they have to immediately report that to the U.S. government. They have been exposed to classified material and they have to protect the security clearance.”

This sort of problem can be managed, said Charron. She has worked at the Privy Council Office’s Security and Intelligence Secretariat and has held high-level security clearance. “You learn what that line is that you cannot cross,” she said.

Charron said she wishes the military proper had a program for temporarily embedding academics.

“Especially in this threat environment, we should take advantage of the [fact] that we do have very highly skilled public servants and academics. And together, we can only improve the security status for Canada,” she said. In their public work, even the best researchers don’t have a perfect understanding of what day-to-day life is like in the institutions they study.

“The more information that academics have, I think we ask more appropriate questions, we dig a little deeper, we have a little bit more understanding and sympathy for the subjects—so that we are taking into account things like budget shortages and personnel shortages, which need to be part of the variables we consider, which we often don’t,” she said.

Parsons said he’ll be keen to see whether CSE is most interested in theoretical work, like the Tutte Institute’s, or directly practical kinds.

“In the United States, the No. 1 organization that hires mathematicians is the NSA,” he said.

Cryptography relies on extremely large numbers to obfuscate (or discern) the patterns in meaningful communications, for instance, numbers so big that how they behave is a field of study in itself.

Just storing and processing the colossal quantities of unencrypted data that spy agencies intercept is a problem that reaches into advanced information theory, he said, one they share with big-data companies like Google.

There is, he said, no realistic way to address ethical concerns about using academic research for offensive cyber capabilities by applying research funding only to defensive problems.

“If you’re developing a strain of math that you might not have otherwise developed, and that strain of math is used to better enable the bulk collection or mass surveillance that’s undertaken by the Five Eyes,” he said. “It can be ‘cleaner’ in the sense that you can pretend as though you’re a step removed from it, but you’re still involved in that kind of mathematics.”

Someone studying how a long-range missile could be targeted on Canada by a potential adversary is also studying how Canada might fire a missile in the opposite direction, Parsons pointed out. Cyberwarfare is no different.

There will be practical problems to address: Charon said the federal government had notorious backlogs in processing clearances then, and there’s little sign they’ve improved. Vetting an academic to see classified information for a limited period could be an obstacle; the wait might even take longer than a research position is funded for.

Still, she said, CSE’s willingness to try is encouraging. “I think this is great. And I really hope one day I can take advantage.”