Privacy Commissioner’s report calls on the RCMP to increase transparency around the use of cellphone surveillance tools

A complaint launched by OpenMedia into the use of IMSI-catchers (a.k.a Stingrays) reveals that six warrantless deployments of the device violated the Charter

September 14, 2017– Today OpenMedia makes public the results of its complaint to the Office of the Privacy Commissioner (OPC) regarding the RCMP’s potential use of IMSI-catchers, spying devices more commonly known as “Stingrays”. These devices can collect location and identification information from everyone in a given area, by tricking cellphones into connecting with them as they would a cell tower.

The report published today is the result of a thorough 18-month investigation by the Privacy Commissioner, prompted by a complaint from OpenMedia’s Laura Tribe. Among the key concerns raised in the complaint were that the RCMP may be using IMSI-catchers to collect tracking information, monitor large groups of people, and intercept private communications data. The complaint also raised questions about whether a warrant is required to authorize the use of IMSI-catchers and whether the threshold for authorizing such a warrant is sufficient given the invasive nature of the devices.

In its report, the Privacy Commissioner notes that a “lack of transparency lead to serious concerns about the capabilities of the devices, and how they are being used,” and confirmed that the RCMP reported that in 2015 there were six cases in which Stingrays were used where no warrant was sought — which the Privacy Commissioner concluded was a clear violation of the Charter.

In response to the report, OpenMedia’s Executive Director Laura Tribe said: “We launched this complaint to get answers from the RCMP about the scope and use of IMSI-catchers, but we should never have needed such a lengthy investigation merely to obtain basic information about how the data of innocent Canadians is being collected and stored by police. Citizens are often told if they have nothing to hide they have nothing to fear. So it seems ironic it took almost two years of external investigation to finally bring the RCMP’s own secrets around over a decade of IMSI-catcher use to light.”

Tribe continued: “It’s clear from this report that much more needs to be done to strengthen safeguards around the use of IMSI-catchers, including raising the threshold of evidence required before these invasive devices can be deployed. This is a pressing issue that must be taken up by the federal government when Parliament returns next week.”

Key takeaways from the report include:

• OPC identified six cases in 2015 where no warrant for the use of an IMSI-catcher was sought, and there were no exigent circumstances involved. It concluded that in these six cases the RCMP’s collection of personal information was not Charter-compliant, (paras. 45 & 46) and were not lawfully executed. (para. 58)

• OPC concludes that the RCMP’s “lack of transparency lead to serious concerns about the capabilities of the devices, and how they are being used.” They go on to “strongly encourage the RCMP to continue to make efforts towards openness and accountability in terms of the technology it employs in its law enforcement activities and the legal authorities it relies on for the use of those technologies.” (para. 61)

• OPC found that the the RCMP is still operating under an “interim” policy on the use of IMSI-catchers, issued in 2011. (para. 19) However they are currently in the process of implementing a new and more detailed policy. (Appendix C)

• The types of IMSI-catcher deployed by the RCMP is not capable of intercepting the content of voice, audio, text, or email communications. (para. 13) However they can and do collect identity and location data: the IMSI and IMEI numbers associated with every mobile device. (para. 14) This can then be used to ascertain the name, address, and phone number of the owner of that device. (para. 17)

• In total, the RCMP deployed IMSI-catchers in 125 criminal investigations from 2011-2016. 91 of these deployments were authorized by general warrant, 22 by a transmission data warrant, but in the case of 13 deployments no prior judicial authorization was obtained. Seven of these 13 cases presented exigent circumstances.

OpenMedia is calling on the government to create strict authorization requirements for Stingrays that reflect the unique privacy implications and invasive nature of these devices, and on the RCMP to proactively publicize the updated internal policies for their use.

The full Office of the Privacy Commissioner report can be downloaded here.

Canadians are continuing to speak out against invasive Stingray surveillance at StopStingrays.org