RCMP reveals use of secretive cellphone surveillance technology for the first time

The RCMP for the first time is publicly confirming it uses cellphone surveillance devices in investigations across Canada — but at the same time says the potential of unauthorized snooping in Ottawa, as reported by CBC News, poses a threat to national security.

"Absolutely," RCMP Chief Supt. Jeff Adam, who is in charge of technical investigations services, said in an unprecedented technical briefing Wednesday with reporters from CBC News, the Toronto Star and the Globe and Mail.

The RCMP held the briefing in the wake of a CBC News investigation that found evidence that devices known as IMSI catchers may be in use near government buildings in Ottawa for the purpose of illegal spying.

It is publicly known there is equipment out there that is not limited in its capturing of communications between devices.- RCMP Chief Supt. Jeff Adam

"Not everyone uses the equipment in the way the RCMP does," Adam said. "It is publicly known there is equipment out there that is not limited in its capturing of communications between devices. And so it's a security risk when it is used in proximity to government and/or any other commercial enterprises."

Public Safety Minister Ralph Goodale said Tuesday the devices detected did not belong to any Canadian police or intelligence agency.

Adam told reporters that while he isn't "personally aware" of foreign agencies using the technology in Canada, "I can't rule that out." 

The RCMP and CSIS are now investigating.

• CBC INVESTIGATES | Someone is spying on cellphones in the nation's capital
• RCMP, CSIS launch investigations into phone spying on Parliament Hill
• Devices that track, spy on cellphones found at Montreal's Trudeau airport

But on Wednesday, after shrouding their own use of the technology in secrecy for years, the RCMP took the unprecedented step of speaking publicly about the devices — also known as Stingrays or Mobile Device Identifiers (MDIs) — to address public concern amidst mounting questions about their use.

Other police forces have them, too

The RCMP says that MDIs — of which it owns 10 — have become "vital tools" deployed scores of times to identify and track mobile devices in 19 criminal investigations last year and another 24 in 2015.

He says in all cases but one in 2016, police got warrants. The one exception was an exigent circumstance — in other words, an emergency scenario "such as a kidnapping," said Adam, whose office tracks every instance where an MDI has been used by the RCMP.

"This technology is a vital tool in providing valuable assistance to criminal investigations," Adam said, adding some recent media reporting has misstated how police use MDIs and what the technology can actually do.

He says using an MDI requires senior police approval as well as getting a judge's order. And he says the technology provides only a first step in an investigation allowing officers to identify a device.

He says only then can police apply for additional warrants to obtain a user's "basic subscriber information" such as name and address connected to the phone. Then, he says, only if the phone and suspect are targets of the investigation can police seek additional warrants to track the device or conduct a wiretap to capture communications.

Adam says the RCMP currently has 24 technicians trained and authorized to deploy the devices across Canada. He knows other police forces own and use them too, but declined to name them.

RCMP device 'does not collect' texts, emails, calls

He said the RCMP's devices are restricted in their use, with software that only allows them to identify a mobile device and to potentially track the location of that phone.

"What the RCMP technology does not do is collect private communication," Adam said. "In other words, it does not collect voice and audio communications, email messages, text messages, contact lists, images, encryption keys or basic subscriber information."

There do exist interception tools that allow eavesdropping on phone calls and direct interception of digital messages but Adam said the RCMP does not own them or use them.

He said anyone operating in Canada without a proper licence or judge's authorization would be breaking section 191.1 of the Criminal Code that prohibits possession of these kinds of interception devices. He also said it would be a violation of the Radiocommunications Act.

RCMP lacked proper approval

Adam conceded that until two months ago the RCMP itself failed to get express approval to use MDIs from Innovation, Science and Economic Development Canada (ISED, formerly Industry Canada), the government body responsible for regulating technology that might interfere with wireless communications.

He said the RCMP believed at one point that an exemption introduced in early 2015 to the Radiocommunications Act allowing the use of cellular "jammers" might also exempt the use of MDIs — but ISED ultimately disagreed.

Otherwise, he said police have almost always sought a warrant, though he noted a few exceptions.

He said in recent years the law has changed to catch up with emerging technologies.

Police used to apply for a general warrant to use the technology. In 2015, Adam said there was a period of at least six months — between March and October — when the RCMP didn't seek a warrant at all, acting on advice from the Department of Justice and government prosecutors. 

RCMP say that in the past five years — including this period — police used the devices without a warrant in 11 investigations.

Innocent users' data

IMSI catchers have been highly controversial for fear that hundreds of innocent device users can be swept up in the collection of cellular data.

Adam said all data collected is strictly protected, isolated and reported to judges, preserved until it is no longer needed and then destroyed.

"The data, once it is seized lawfully to the judge, will be secured and locked up for criminal court purposes. It will not be accessed other than the target information," Adam said.

He said the RCMP has been fully co-operating with the Office of the Information and Privacy Commissioner, which has been investigating police use of cellphone-tracking equipment in Canada.

He also said police are very aware that cell MDIs can potentially disrupt mobile users' signals and even, in older phones, interfere with the ability to dial 911.

Adam said the RCMP has developed protocols to ensure the MDIs — which essentially highjack all cellular signals in a given area — are only used for a few minutes at a time to limit potential disruption for users.

He said that while his office is tracking the numbers of warrants and applications, currently the law requiring police to report to Parliament on interception techniques does not expressly require them to detail how many times they use cellphone-catching technology.

"We're not averse to reporting, to a degree, on the number of times this technology is used, but there is as of yet no requirement to do so," Adam said.