CSIS says it needs security changes to do its job