An 2011 internal report urges detectives to reduce the range of IMSI catchers and run them for no more than three minutes at a time.
The Mounties have been using portable devices to target the telecommunications of crime suspects despite knowing that such surveillance runs the risk of knocking out phone calls from "innocent third parties" – including people dialling 911.
An RCMP internal memo written in 2011 shows that police commanders have long warned their detectives that so-called IMSI catchers – devices that mimick cellphone towers – are run at a calculated risk to public safety. In hopes of reducing potential harm, the memo urges detectives to reduce the range of the devices and to run them for no more than three minutes at a time.
The Globe and Mail reported last month on a Montreal court case that revealed the first confirmed use of an IMSI (international mobile subscriber identity) catcher in Canada. Now, the five-year-old police memo has surfaced from within thousands of pages of disclosure related to the case that highlights a police assessment of the drawbacks.
The RCMP have used IMSI catchers since at least 2005, but until now, only police and the judges who grant warrants have known about it. Government officials will not publicly acknowledge the devices are in use.
The RCMP memo suggests police in Canada are expanding their use of IMSI catchers, even as commanders warn detectives of the dangers. "When considering whether the use of the [IMSI catcher] should be authorized … officers should weigh the need to prevent imminent bodily harm, preserve life and investigate serious crimes … against the importance of having a reliable 911 system that Canadians can count on in all circumstances," it reads.
How the RCMP's secret surveillance tools work
RCMP documents disclosed in a recent trial acknowledge that portable surveillance devices, used to target crime suspects, directly impact "innocent third parties" within range — including people dialling 911.
The devices, known as IMSI catchers, mimic cellphone towers and are capable of extracting key identifiers such as the International Mobile Subscriber Identity (IMSI) from nearby GSM phones.
MURAT YÜKSELIR/THE GLOBE AND MAIL
1 A police team turns on its device causing radio waves to emit from an unmarked police vehicle. The machine beckons to phones suggesting it is the strongest cellphone tower in the area.
2 It’s a “hit” – the targeted person’s phone automatically redirects its signal to the police device.
3 The suspect’s phone has unique digital identifiers that are pulled into a database – as are those of phones belonging to innocent third parties. Police can later try to bug the target phone.
4 The police devices can have the side effect of temporarily blocking all new calls – and while 911 calls are supposed to override the interference, up to half the time this does not happen.
The memo says that when the device is turned on, it can block new calls on all phones in the vicinity, including attempts to dial 911, and deliver bystanders' identifying data to police.
Police and intelligence officials in some other countries, such as Germany, are required to tell their legislatures about their use of IMSI catchers. In North America, police and intelligence agencies are unwilling to highlight their surveillance capabilities.
The devices imitate cellphone towers, allowing their operators to capture identifying data from nearby cellphones. The Canadian court case shows that RCMP surveillance detectives in Montreal used this technique five years ago to identify the phones controlled by Mafia suspects hatching a murder conspiracy.
Police could later eavesdrop using other technology. (Police in Canada say they avoid IMSI-catcher capabilities that could intercept text messages or conversations.)
Filings in the Montreal case show the RCMP equipment can have a range of up to 500 metres in a city, and every time such a device is turned on, it captures data from the phones of innocent bystanders. One filing in the Montreal case shows that while police were pursuing only a handful of mobsters' phones, they got a lot of others. "In the course of three minutes of using the technique, 136 different devices were intercepted," the filing says. The technique was used in Montreal many times over many months.
That was in September, 2011. Earlier that year, Mountie brass in Ottawa had circulated the memo clarifying the police policy on the devices, which the RCMP call "mobile device identifiers" (MDIs).
High-ranking Mountie detectives across Canada were told that their MDI use would no longer have to be preapproved by Ottawa headquarters. Instead, senior detectives were given greater discretion to use the technology in conjunction with other, unnamed law-enforcement partners – so long as everyone was "fully aware of the risks associated."
In the memo, the Mounties were told their warrant-application wording "must not reveal sensitive police techniques," but they had to be frank with judges about the impact on "targeted and non-targeted mobile phones."
A primer attached to the RCMP memo, subtitled "MDI Impact on the public," described those considerations: "When it attracts all the mobile telephones in its range, the MDI may, depending on how it is used, temporarily take them off the public telecommunications network."
The memo explained that while this was an an inconvenience for most people trying to make or receive a call, it could also affect urgent calls for help. And while the RCMP had a 911 fix, it was imperfect. "The MDI will shut itself off if a mobile telephone within its range calls 911. However, recent testing at [headquarters] revealed that more than 50% of the GSM mobile telephones tested had not automatically completed their 911 calls after the MDI had shut itself off." (GSM is an airwave standard major mobile-phone companies in Canada use.)
RCMP detectives were further told that while most 911 callers could probably redial, police should take steps to reduce risks. "It is recommended that the range of the MDI be limited as much as is reasonably necessary," one tip reads. Another said the machines should be on only briefly – "no longer than 3 minutes at a time, with a rest period of at least 2 minutes between each use."
In such a way, the memo said, the Mounties could better safeguard "non-targeted mobile telephones and their access to 911 services" and limit the amounts of data drawn from "innocent third parties."
It is unclear how much the surveillance devices are still affecting 911 calls in 2016. The RCMP would not comment. "We generally do not comment on specific investigative methods, tools and techniques outside of court," said Sergeant Harold Pfleiderer, an RCMP spokesman.
Additional filings in the Montreal case highlight other issues Mounties red-flagged internally regarding IMSI catchers.
One highlighted problem was that judicial warrants do not necessarily inoculate police from running afoul of Canada's radio laws. Under the Radiocommunications Act, interfering with or obstructing the public airwaves can result in a one-year jail term.
In sworn testimony, several Mounties acknowledged they knew using IMSI catchers could expose them to this law – although they felt their three-minute-maximum policy probably kept them in the clear.
On the issue of bystanders' data, RCMP affidavits say information caught by IMSI catchers is relayed to a controlled facility in Ottawa. Detectives can search these pools of data only for phones relating to suspects and persons of interest.
That said, bystanders' phone data is not necessarily destroyed once it gets to Ottawa. "All inconclusive results, information concerning non-targeted persons or other information gathered in the database are not given to the investigators and [are] kept under the control of the RCMP 'Special I' Unit," reads one filing in the case. (Special I is the police force's surveillance unit.)
The 2011 RCMP memo came with a proviso that it "contains information about sensitive police techniques and should be protected." However, it surfaced in the Montreal case as six accused murder conspirators pressed for disclosure about police devices used against them.
Led by Toronto lawyers Frank Addario and Michael Lacy, this strategy resulted in an unprecedented Canadian disclosure about modern police practices.
On March 30, the six accused were acquitted of first-degree murder and pleaded guilty to lesser charges of conspiracy. It is not clear why the Crown agreed, but the pleas ended an ongoing bid by the accused for disclosure, and also scuttled a Quebec Court Appeal Court hearing that would have clarified the legalities of police use of IMSI catchers.
Colin Freeze