The country's biggest police force has broken a decade-long silence surrounding its use of surveillance machines that can indiscriminately pull data off Canadians' cellphones.
"We've maintained use of this device only in serious cases," RCMP Chief Superintendent Jeff Adam said on Wednesday. He said these machines, which work by imitating a cellphone tower to phones in a given radius, were used by the Mounties in 19 investigations in 2016 and 24 investigations in 2015.
Chief Supt. Adam, the RCMP's director-general of technical-investigation services, spoke about the surveillance equipment in a technical briefing to reporters from The Globe and Mail, the CBC and the Toronto Star. He said he did so because it was time for police officials in Canada to be more transparent.
The briefing comes as new surveillance capabilities raise concerns about legalities and privacy. For instance, in March, 35 organized-crime cases in Quebec were mysteriously scuttled after police lost their fight to obscure their surveillance techniques. And this week, reports emerged of suspicious surveillance activity taking place around Parliament Hill and Montréal-Trudeau airport, with Public Safety Minister Ralph Goodale saying the agencies he controls, including the RCMP, were not responsible.
Such news has put the spotlight on once-obscure devices known as "IMSI catchers" – and who may use them.
The RCMP run their versions of these devices under very tight strictures and only to draw very limited amounts of data, according to Chief Supt. Adam. But he added that people who threaten national security or commit industrial espionage know no such restraints. "Not everyone uses the equipment the way the RCMP does," he said. "There is equipment out there that is not limited in its capturing of communications between devices."
The RCMP's IMSI catchers are incapable of intercepting phone calls, e-mail exchanges, text messages, contact lists or similar material, according to Chief Supt. Adam, who added that the force has just 10 of the devices, which are run by 24 trained technicians.
These devices can only dredge up two distinct digital identifiers: the international mobile-subscriber identity (IMSI) and the international mobile-equipment identity (IMEI) serial numbers, which are engineered into every cellphone and the chips within.
Though not very revealing in themselves, these numbers give detectives something to go on when other investigative methods fall short. Often, police can use this data to approach phone companies for more information about particular phones – including who the owner might be. After that, they can go to judges to seek clearance for follow-up surveillance campaigns done with other police devices.
Whether police need warrants to operate IMSI catchers has at times been a grey area. An RCMP spokesman said there have been 11 occasions in the past five years where the police force sought no prior judicial authorization before using the machines. Yet laws passed by Parliament in recent years have clarified that police should go to court and ask for specific surveillance powers.
One power they occasionally seek is a transmission-data-recorder warrant. Police surveillance teams, who shadow known suspects with unknown phones, can use this power to operate an IMSI catcher. While it will grab identifiers on all the phones in a large radius, detectives can eventually zero in on particular phones through a process of reductive logic, police eyeballs and time.
Police sometimes also seek what's known as a tracking-warrant power, which allows them to stay close to a known phone carried by a known suspect.
A third scenario involves urgent circumstances. Police may want to get a read on the phone of a kidnapping victim, for example; in that case, they are allowed to do the tracking first and go to a judge later.
Volumes of data drawn from the phones of bystanders, which may be temporarily knocked offline, are an inevitable byproduct of IMSI catcher investigations. Some privacy and regulatory problems first brought to light by The Globe and Mail last year were broadly confirmed by Chief Supt. Adam during Wednesday's discussion.
In Canada, police run IMSI catchers with the knowledge that they may knock out emergency calls as the device redirects signals in a given area away from cellphone towers. "Some – and few now – older phones may be disrupted if they are attempting to make a 911 call during that very limited period of time in which the [IMSI catcher] technology is operating," Chief Supt. Adam said. He said this is partly why the Mounties only run their machines for short spurts on specific spans of the spectrum.
He also explained that the RCMP's use of the devices did not formally comply with federal radio-wave rules until about two months ago because the force misread the law. The RCMP have since sought formal permission from regulators to use the devices.
"We were, in fact, in potential violation of the Radiocommunication Act, but based on the fact that we were working with [federal regulators], it was not an issue," Chief Supt. Adam said.
What police gather in the course of an investigation is considered evidence, and pools of data identifying cellphones – even those of bystanders – are no exception. Supt. Adam said such data is tightly controlled by the RCMP, and detectives can only query it for information relating to suspects.
He wouldn't say where the force gets its equipment. Police can never be fully transparent about their technology, he added.