Canada must acknowledge, and then constrain, the government's use of portable surveillance devices that can indiscriminately dredge data from people's smartphones without them knowing, privacy experts say.
Everything that is known or suspected about the government's use of these machines – called "IMSI catchers," "cell-site simulators" or "Stingrays" – is chronicled in a comprehensive, first-of-its-kind, 130-page report written by privacy experts and released to The Globe and Mail.
Federal police have used these devices for more than a decade, but the practice was confirmed only this year in a series of stories in The Globe. Now, researchers Christopher Parsons and Tamir Israel say it's time for civil society to debate the pros and cons of IMSI catchers, even if many government agencies still won't discuss them.
"This ongoing secrecy has the effect of delaying important public debates," the report says.
The report was commissioned by the Telecom Transparency Project and the Canadian Internet Policy & Public Interest Clinic. They received grants from the Open Society Foundation, privacy activist Frederick Ghahramani, a Social Sciences and Humanities Research Council Postdoctoral Fellowship Award, and the Munk School of Global Affairs at the University of Toronto.
The report follows Public Safety Minister Ralph Goodale's announcement last week that he is soliciting the public's views on the powers of police and spy agencies. Other countries, such as Germany, have been more open about their use of IMSI catchers.
An "IMSI," which stands for "international mobile subscriber identity," is a unique serial number now affixed to every smartphone's chip set. It is one of several digital identifiers that police build modern investigations around if they can tie a specific number to a specific suspect.
Mr. Goodale's department posted a backgrounder stating that police are frustrated by criminals' anonymous use of computers and phones. Canada may need to pass laws that facilitate the flow of customer data – including IMSI data – from telecommunications corporations, the government backgrounder suggests.
Yet mention of the technological equalizers that allow police to bypass corporate gatekeepers have been left out of the government's consultation exercise. For some pro-privacy advocates, this is the conversation Canadians should be having.
"IMSI catchers pose a particularly insidious threat to real-world anonymity," write Mr. Parsons and Mr. Israel, who are part of digital-research labs at the Universities of Toronto and Ottawa respectively. Their paper, which is titled "Gone Opaque," points out that corporations that manufacture IMSI catchers often swear police to non-disclosure agreements.
They suggest the scope of IMSI catchers is currently limited only by the imaginations of government agents who use them. "They can be deployed to geolocate and identify individuals in private homes, to see who visits a medical clinic or a religious meeting, or to identify travelling companions," the research paper says. "They can be deployed permanently at border crossings, airports or bus depots, or distributed at various points of a city so that movement becomes effectively impossible without a record of it being created."
Officials won't say much about IMSI catchers. Freedom of Information requests filed in several provinces have been rebuffed with can-neither-confirm-nor-deny statements. The Toronto Police Service has avowed publicly that it doesn't have such a device, even though its detectives recently used one. Montreal prosecutors tried to suppress discussion of an IMSI catcher in a criminal trial, telling judges they didn't want to broadcast the police playbook to mobsters.
Most dramatically, federal prison officials at the Warkworth Institution in Ontario appear to be under criminal investigation for unlawful use of an IMSI catcher. An effort that aimed to contain contraband phones outraged prison guards, after their warden conceded their personal conversations may have been inadvertently intercepted by such a device.
Mr. Parsons and Mr. Israel point out that Germany releases annual statistics on that government's use of IMSI catchers, and that the U.S. Department of Justice has posted the rules that American authorities must abide by.
In Canada, RCMP-led surveillance teams are understood to control IMSI-catcher technology and lend it out to smaller police forces shadowing specific suspects. But IMSI catchers also pull digital identifiers from the phones of everybody in proximity, raising many privacy questions.
"Collateral impact is inherent in the functioning of IMSI catchers," the research paper says, pointing out that a U.S. court recently imposed a 48-hour deadline on police to destroy bystander data.
No such deadline is known to exist for RCMP-led teams, whose officers get approvals from judges after swearing catch-all "general-warrant" applications. Mr. Parsons and Mr. Israel argue that specialized, higher-threshold warrants for IMSI catchers are needed.
The authors argue that authorities should also routinely notify bystanders if their phone data have been inadvertently captured. "Given the potential for IMSI catchers to massively track Canadians who have done nothing wrong other than be near the surveillance device, it is imperative to ensure the aforementioned measures are in place."