RCMP phone tracking continues despite privacy concerns

Open this photo in gallery:

The RCMP in the Lower Mainland have continued to use a tool that allows investigators to track suspects based on the location of their cellphones, despite failing to finalize a policy on how to address significant privacy issues raised about the technology.

Documents obtained through an access-to-information request that took more than 18 months show that between July, 2015, and March, 2021, the RCMP used the Stingray-type technology 112 times, with 57 per cent of those deployments being for drug investigations. The documents included copies of the RCMP’s 2017 interim policy on the use of the technology and a 2020 draft policy.

Advocates for civil liberties and digital privacy have long been concerned about how often and why the technology is being used, and who is approving it.

“It’s the kind of information that should be made available to the public. We should be aware of this and not have to catch up after the fact by having to use niche things” such as filing access-to-information requests, said Meghan McDermott, policy director of the BC Civil Liberties Association.

The federal police force has generally been tight-lipped about cell-site simulators (CSS), also known as international mobile subscriber identity (IMSI) catchers, or by the brand name Stingray. Use of the technology by the RCMP became public after the federal Office of the Privacy Commissioner (OPC) raised it in a report in September, 2017.

The cell-site simulators work by mimicking legitimate mobile-device towers to receive cellphone signals and they capture metadata on not only the targets of investigations but all cellphones in a given area.

Some versions of the device are also capable of intercepting communications transmitted by cellphones, but the OPC confirmed in 2017 that the CSS technology used by the RCMP only captures a phone’s unique identifier and its current location.

This remains true of the devices owned by the force, RCMP spokesperson Corporal Kim Chamberland said in a January e-mail. Still, groups advocating for civil liberties and privacy rights are critical of the technology because of how invasive it can be and the wide net it casts.

“In the authorization of a cell-site simulator, you’re collecting a whole host of information about individuals that aren’t part of the investigation; they just happen to be in the geographic area in which this device is operating,” said Bryan Short, digital-rights campaigner with OpenMedia, a non-partisan advocacy organization.

“So we’re talking about potentially thousands, tens of thousands … of people’s device ID, location information getting collected as part of this investigation.”

In a draft policy published in 2020, the RCMP said the force may only use the devices after obtaining a warrant or in “exigent circumstances,” defined as “circumstances where it is necessary to prevent imminent bodily harm or death to any person.”

Cpl. Chamberland said in her e-mail that the 2020 draft policy has still not been finalized, despite the agency having used the technology since July, 2005.

“The policy is expected to be finalized within this calendar year, at which time it can be shared,” she wrote on Jan. 24.

“Formalizing policy around the CSS is complex as it relates to a specific technology. As this technology continues to evolve, consultations are required to address changes in capability, operation, legal and privacy implications, and health and safety. This involves many stakeholders within and external to the RCMP.”

Mr. Short of OpenMedia said the lack of a finalized policy was “certainly shocking.”

The 2020 draft policy shows little change from the initial policy introduced in 2017, just before the Privacy Commissioner’s report was released.

In an e-mailed statement on Jan. 27, the OPC did not comment on the lack of a finalized policy when asked about the RCMP’s use of the CSS devices.

Cell-site simulators are part of a slate of technologies to which law enforcement agencies have access that have raised concerns about privacy. Other emerging investigative technologies have similarly seen questions or criticisms about the guardrails in place for their use.

Late last year, The Globe and Mail reported that the safeguards set up around using emerging technologies, including facial recognition, were underfunded and understaffed.

Last summer, the House of Commons committee on access to information, privacy and ethics held hearings into law-enforcement agencies’ use of other controversial tools, including spyware, that secretly capture data from cellphones. RCMP officials declined to provide some of the information sought by MPs during the hearings.

In November, the committee recommended the federal government strengthen the Privacy Act and establish standards for law enforcement’s use of spyware technologies. The recommendations did not specifically mention CSS devices.

According to the data obtained through the access-to-information request, the RCMP’s use of the CSS devices between July, 2015, and March, 2021, was most prevalent in Vancouver (45 times); followed by Surrey (31 times); Richmond (11); Burnaby (9); and Langley (6).

The data also show a significant drop-off in deployment of the technology in the Lower Mainland after the 2017 interim policy was put into place.

In the second half of 2015, the technology was used eight times. In 2016, it was used 60 times. A year later, CSS devices were used 32 times. They were used four times in 2018; once in 2019; and twice in 2020.

Cpl. Chamberland, in her January e-mail, said the privacy commissioner’s report, as well as court and technological challenges meant the use of the device was curtailed for a time following 2017.

“Once the use of this equipment was better understood by the courts, the OPC and the public, and the technical challenges were overcome, the use of the CSS increased,” she wrote.

Between Jan. 1, 2021, and March 18, 2021, the technology was used five times, according to the data, almost as many times as in 2018, 2019 and 2020 combined.

According to the data, in the time period covered by the access-to-information-request, the technology was used 64 times (57 per cent of all deployments) in investigations connected to the Controlled Drugs and Substances Act, compared with 40 times (36 per cent) in homicide investigations; four times in investigations classified as “homicide/drugs/organized crime;” three times in kidnapping cases; and once for training.

Ms. McDermott of the BC Civil Liberties Association, which is in favour of drug decriminalization, said she’s concerned about the technology being used so heavily in drug investigations.

“We would expect that judicial authorizations are almost always required to use these kinds of devices and that their use is tightly circumscribed,” she said.

When CSS devices are used during drug investigations, Cpl. Chamberland wrote in her e-mail, “there would be a serious and organized crime component involved.”

She added that the RCMP doesn’t object to regular reporting to the OPC regarding the force’s use of the investigative tool “so long as it protects the integrity” of continuing investigations.

“The public needs to be aware that the use of these tools is for a narrow scope of serious criminal investigations that affect the safety and well-being in their communities,” she wrote.

“These tools and the data obtained by them are not used by the RCMP to complete mass surveillance, nor is the equipment shared with other agencies. The privacy of Canadians is important and is maintained during these investigations.”

Special to The Globe and Mail