OTTAWA — The national cyberspying agency will benefit from the Liberal government’s plan to build up Canadian defence capabilities but is claiming a blanket exemption from buying from Canadian vendors itself, its internal documents say.

Caroline Xavier, chief of the Communications Security Establishment (CSE), signed off on a March proposal to say everything the agency does is a “sensitive operation” and qualifies for exclusion from the government’s Buy Canadian policy, according to documents released in response to an access-to-information request from The Logic.

The agency, like the Department of National Defence, Canadian Security Intelligence Service and Canada Border Services Agency, is subject to the Buy Canadian policy the government implemented in December 2025, which is meant to “strengthen Canada’s economic resilience by leveraging federal procurement to prioritize Canadian suppliers, materials and content.”

The policy requires federal departments and agencies to prioritize Canadian suppliers and materials when making purchases. But it allows exemptions for things like purchases for the military, for embassies and consulates abroad—and for “sensitive operations,” a term it doesn’t define.

In the March memo, the CSE’s chief financial officer, Julie Chassé, told Xavier that Public Services and Procurement Canada (which does much of the buying for other parts of the federal government) would take the agency’s word on anything it wanted to label sensitive.

“CSE is seeking Chief endorsement and approval to apply the ‘sensitive operations’ exclusion to all CSE procurement,” and to send “blanket letters for exclusion” to agencies that buy things on CSE’s behalf, Chassé’s note said. Xavier agreed.

In response to questions from The Logic, CSE spokesperson Marie-Pier Baril said despite the words in the memo, it did not mean that all CSE procurement would be excluded from Buy Canadian rules.

“The term ‘blanket’ referred to establishing the consistent application of the Buy Canadian Procurement Policy Framework across procurements supporting CSE, including those conducted on CSE’s behalf by common service providers. It did not mean that every procurement is automatically excluded from the framework,” Baril wrote in an email.

CSE refused to explain the discrepancy on the record.

The Communications Security Establishment is a defence agency that leads government efforts in cyberspying, cyberdefence and more traditional types of signals intelligence. It has its own research institute in cryptography and data science, where experts do largely classified work on security- and intelligence-related science.

It’s seen its budget nearly double over the past two years, to more than $2 billion, as the federal government has increased defence spending generally and sought to improve national cyberdefences.

CSE already does much of its purchasing from Canadian suppliers, Chassé’s memo said; 87 per cent of its procurement had gone to Canadian vendors to that point in the 2025–26 fiscal year. CSE would support the spirit of the Buy Canadian policy, she wrote, by buying from Canadian sources “if and where possible.”

But the prospect of being bound to the policy raised concern for Chassé. “Without utilizing the ‘sensitive operations’ exclusion, CSE’s procurements will remain fully subjected to the framework’s mandatory requirements, including procurement to Canadian suppliers only,” she wrote.

She apparently went on to make a brief argument for why that would be bad, but the passage was redacted from the publicly released document.

The Logic asked whether CSE could explain the harm. Baril didn’t answer directly, but wrote that, as a security agency, CSE has to be careful what it discloses: “In some circumstances, additional procurement requirements could result in the disclosure of information related to operational priorities, technical requirements, capabilities, or suppliers, which may expose sensitive operational details and increase the risk of adversarial compromise.”

The agency is already exempted from disclosing procurement information publicly; almost none of its contracts is listed in the open database of government deals.

At about the same time as she agreed that buying Canadian should be optional for CSE, Xavier received a separate report on all the ways the new federal defence industrial strategy would benefit the agency. It would funnel money into fields in which CSE is a key player, including artificial intelligence, quantum computing and cybersecurity, for instance.

The defence industrial strategy’s “emphasis on increasing sovereign capabilities, prioritizing advanced research and innovation, and expanded engagement with industry will likely create favourable conditions for upcoming CSE modernization initiatives,” that document said.

The strategy also talks about boosting industrial security. CSE plays a role in that, too, and is working on an accreditation standard for eavesdropping-resistant rooms in private buildings (typically called sensitive compartmented information facilities, or SCIFs). 

Baril wrote that the agency intends to work with Canadian industry on all of that: “CSE remains committed to engaging with Canadian suppliers and innovators while ensuring that its procurement decisions continue to meet the security, operational and technical requirements necessary to fulfill its mandate.”