Facebook accounts, Instagram feeds, Starbucks hotspots. These are provided free not out of the goodness of the company’s collective heart, but because they profit in other ways. And as U.S. privacy whistleblower Edward Snowden has proven, security agencies have a taste for your online data as well.

The latest battlefield in the war on online privacy is in Canada’s airports, where CBC News reports passengers have fed their information to Canada’s electronic spy agency hand over fist.

In an exclusive report, CBC claims top secret documents obtained by Snowden show that the free Internet service available at a Canadian airport was used to track wireless devices of those who log in, sometimes for days after the fact.

In short, when someone logged on to that Wi-Fi hotspot and fired off a few emails before boarding their flight, they could have shared information with more than just the email’s recipient. Metadata could have also been spread, detailing a trove of information about the habits and activities of the user.

Communications Security Establishment Canada was quick to respond to the report, stating that it is the agency’s mandate to “collect foreign signals intelligence to protect Canada and Canadians, and by law, only directs its foreign intelligence activities at foreign entities.” Basically, no Canadians were harmed in the collecting of this metadata.

In order to fulfill this key foreign intelligence role for the country, CSE is legally authorized to collect and analyze metadata. In simple terms, metadata is technical information used to route communications, and not the contents of a communication.

The classified document in question is a technical presentation between specialists exploring mathematical models built on everyday scenarios to identify and locate foreign terrorist threats. The unauthorized disclosure of tradecraft puts our techniques at risk of being less effective when addressing threats to Canada and Canadians.

It is important to note that no Canadian or foreign travellers were tracked. No Canadian communications were, or are, targeted, collected or used. And all CSE activities include measures to protect the privacy of Canadians.