A Federal Court judge says CSIS violated the law by keeping potentially revealing electronic data about people who posed no security threat over a 10-year period.