An RCMP officer and a retired Vancouver cop say not even police are safe from high-tech spyware
Pair allege RCMP used phone-hacking technology on them as witnesses in ongoing foreign interference case
Retired Vancouver police officer Paul McNamara was out with his family in August 2023 when he had a phone conversation with a friend, Ontario RCMP officer Pete Merrifield.
As he talked, he noticed his phone became unusually hot, "like it was about to melt down."
At the time, McNamara, who retired from the Vancouver Police Department in 2016, was on vacation in Montreal. When he tried to order an Uber, he says his phone was locked due to "too many password attempts."
He found it odd, but brushed it off as a glitch.
Then, that fall, he learned that the national police force had used controversial spyware called an On-Device Investigative Tool (ODIT) to remotely hack into his and Merrifield's phones. This was revealed thanks to evidence in an ongoing court case involving another former RCMP officer where McNamara and Merrifield were witnesses.
McNamara says ODITs allow police to read messages on a person's phone in real time, even on encrypted apps like Signal, but two-step authentication can still otherwise block access to data on certain apps that would require police to know the person's password.
While concerns from privacy advocates and human rights groups have focused on these tools being used to spy on journalists and other citizens, in this case spyware was used on a current and former police officer who say they were only ever told they were witnesses, not suspects, in a foreign interference case.
The two are now raising alarms about how the invasive technology was used in their case and the implications it has for broader police use. Meanwhile, one expert told CBC he worries this type of spyware has surpassed legal frameworks protecting Canadians' privacy rights.
Canada has no legislation regulating spyware
In 2022, a House of Commons privacy committee ordered the RCMP to disclose its "device investigation tools." In response, the RCMP revealed it had been using ODITs to hack phones and other devices since 2017 without notifying the public or the federal privacy commissioner.
Canada currently has no legislation regulating spyware use.
A 2024 RCMP report says the force only deploys ODITs "for serious criminal investigations, such as organized crime, national security and terrorism, cybercrime, or other serious crimes," and that the technique is only used with judicial authorization, and "when other investigative means of collecting evidence have proven to be ineffective."
According to the report, some of the tool's technical capabilities include "intercepting communications, collecting and storing data, capturing computer screenshots and keyboard logging, and/or activating microphone and camera features."
Canada's Public Safety ministry has refused to disclose which vendors supply the RCMP with ODITs and has not denied that other government agencies might also use them.
Just last month, a Citizen Lab report detailed "a growing ecosystem of spyware capability" among the RCMP and multiple Ontario-based police services.
"If it's not kept in check, it could be a disaster — which we believe it is," McNamara said in a phone interview with CBC News.
Toronto-based criminal defence lawyer Adam Boni says ODITs make traditional wire tapping "look like something from the stone age," and that the RCMP's use of them has been "shrouded in secrecy."
He says he has concerns about the lack of independent monitoring and review processes around spyware technology.
"There's a whole cluster of issues that demand transparency and accountability, and we're just not seeing that," he said.
"Whenever you have that type of really powerful state surveillance being utilized, and at the same time, steps being taken to prevent full disclosure of what's being done, it raises serious concerns in terms of privacy rights."
Officers surveilled in foreign interference investigation
McNamara and Merrifield filed a lawsuit together last year against the federal government, seeking $5.5 million in damages and alleging defamation, claiming they lost their security clearances — and in McNamara's case, his job — because of "inaccurate, incomplete, misleading and/or false" information provided by CSIS to their employers.
They say CSIS wrongly implicated them in assisting William Majcher, a former RCMP inspector who was charged in 2023 with helping China conduct foreign interference in a case that is still ongoing.
Though both McNamara and Merrifield say they had known Majcher for years, they both deny having any unlawful associations with him.
Both men say they were interviewed by Montreal RCMP regarding their relationships with Majcher, and both say they were informed they were being interviewed as witnesses. Neither were charged with any crime.
Though Merrifield has since had his security clearance restored, both he and McNamara say they suffered stress, anxiety and depression, as well as embarrassment and loss of reputation. Their lawsuit is still ongoing.
It was through evidence that turned up in court files related to the Majcher case, that they learned the RCMP gained access to their cellphones using an ODIT. They believe RCMP investigators hacked their phones because they were unable to get an ODIT on Majcher's phone, as he was based in Hong Kong.
CBC News also obtained an April 2023 affidavit filed by the RCMP to deploy the ODITs to the officers' phones in the Majcher case that appears to indicate they applied them to the wrong numbers at least twice.
"We don't know if they were defunct numbers, dormant numbers, or if they actually snatched data of an innocent private citizen," Merrifield said in a phone interview with CBC News.
An internal RCMP document from May 2023, also published in the Majcher court case, states the ODITs on McNamara and Merrifield were required "for the purpose of collecting historical messages as well as documentary evidence in support of the offences being investigated" in relation to Majcher.
The RCMP appear to have run into multiple issues accessing the phones. A Sept. 7, 2023, email published in court documents related to the Majcher case details failed attempts to crack passwords for several apps or accounts.
"[H]itting the same account over and over again with a wrong password could lead to the account being locked and raise suspicion by the owner," the email read.
Though McNamara says he can't know for sure that the attempts to crack these passwords were related to him, as there were other numbers subject to the ODITs, he told CBC News in an email that it seemed "more than coincidence" that he was also having issues with his phone at around the same time.
Merrifield, McNamara feel 'betrayed' and 'violated'
Merrifield, who has worked with U.S. federal agencies and overseen security for visits by world leaders, foreign dignitaries and royalty through his work with the RCMP, says he feels "betrayed" by the police force "in a way I could not fathom in my worst f--king nightmare."
He has a history of disputes with RCMP brass and is the co-founder and vice-president of its union, the National Police Federation. He also learned from the April 2023 affidavit that the RCMP had ordered an ODIT on his union phone during the time he was engaged in collective bargaining conversations that year. He says this breached not only his privacy, but the privacy of some 19,000 union members.
In the lawsuit, Merrifield also accuses CSIS of previously using ODITs against him in the Majcher case. A CSIS spokesperson told CBC News in an email that the agency is "unable to comment on the matter as it is currently before the courts."
"It's terrifying. I don't care who you are. It's the most powerful tool available to law enforcement or intelligence," Merrifield said.
"There's no hiding from it. They can turn your phone into a camera. They can turn it into a microphone. You can turn the power off, they can still use the device. It's the most intrusive thing that exists in the world today."
CBC News reached out to the RCMP for comment on McNamara and Merrifield's allegations, but the force declined to be interviewed. It instead sent an emailed statement saying, "It would be inappropriate for the RCMP to comment on this case as the matter is before the courts."
McNamara, who once worked undercover in high-profile covert operations with the Vancouver Police Department, says learning the ODITs were ordered on his devices has left him feeling "violated."
Allowing ODITs to become a mainstream investigative tool erodes citizens' right to privacy, he says, and is a serious breach in ethics, moral obligations and legal procedures.
"Having been in the police, we get this mission creep, where the police will push the boundaries," McNamara said. "And so we start to normalize the behaviour, when they shouldn't be doing this."
Technology has surpassed legal framework: lawyer
A spokesperson for the Office of the Privacy Commissioner of Canada said in an email that the RCMP's use of ODITs primarily falls under part six of the criminal code, which sets out provisions for police to get judicial authorization for intercepting private communications in criminal investigations.
The email also noted that the RCMP is subject to the Canadian Charter of Rights and Freedoms, including the section eight protection against unreasonable search and seizure, which acts as an additional check on the use of ODITs.
The spokesperson would not speak to this specific case, but said the office conducts "voluntary consultations" with government institutions that are typically focused on program design and implementation, and those consultations "are conducted in confidence."
Boni says police use of ODITs in general signals that Canada has entered an era where technology has vastly surpassed the legal frameworks in place for protection of privacy.
He says lawyers, legislators and judges need to take a hard look at whether or not sufficient checks and balances are in place to prevent abuses before they occur.
"The technology is so expansive, it is so capable, that the temptation to abuse it is compelling," Boni said. "We need to have a really serious conversation in this country about the state's use of this technology."
ABOUT THE AUTHOR
