The RCMP has used spyware more than first thought; privacy commissioner calls for changes

Canada’s privacy commissioner is calling for a change in privacy laws, as a House committee investigates the RCMP’s use of spyware to access mobile devices and computers. The Mounties have revealed they have used this technology dozens of times more than first thought.

It’s an issue that’s sounded alarms for privacy and civil liberties groups across the country. The House of Commons ethics and privacy committee called for a summer study after the RCMP revealed its use of tools that covertly obtain data from devices like phones and computers.

In response to a written question tabled in the House of Commons in June, the RCMP disclosed it had obtained warrants to use tools that collect text messages and emails and can remotely turn on cameras and microphones in 10 investigations.

However, in testifying at the privacy committee, Bryan Larkin, deputy commissioner with the RCMP, revealed since 2017, it had been used in 32 investigations, “in which a combined total of 49 devices were targeted.”

Larkin says it’s only used in serious criminal investigations, and not without the approval of a judge.

Privacy commissioner Phillipe Dufresne says his office was not consulted by the RCMP and he didn’t find out until it went public. He wants it to be a legal requirement to consult with his office before technology that could impact Canadians’ privacy is used.

Privacy and technology lawyer David Fraser calls is “the most intrusive thing that exists.”

“This would be like an order allowing the police to kind of put on an invisibility cloak and sit on your living room couch, or on your bedside table.”

Fraser said that’s why a high level of scrutiny should be applied to requests for this type of warrant.

“I think part of the important discussion that should be taking place here? would be to make sure that any technique that is as intrusive as this is subject to the highest standard of probable cause and that the police should have to convince the judge that other techniques have been tried and have failed.”

As an alternative approach, Fraser said the committee could look to the methods used when the Canadian Security Intelligence Service seeks a warrant for its investigations.

“(CSIS officials) go to a bunker in Ottawa and they meet in what amounts to a secret court,” he said. “It’s designated judges of the Federal Court who, ex parte – so without anybody on the other side – review applications for warrants under the CSIS Act that can be incredibly intrusive.”

Technology outpacing the law

Policing expert and Queen’s University professor Christian Leuprecht said technological change is outpacing the legal framework, and politicians are often unwilling to step in and adjust policies to help it keep up.

“This is the sort of issue that requires politicians to sit down and say, ‘OK, we have this technology, this is how we’ve decided you’re allowed to use it,”’ he said.

Leuprecht agreed there should be a high level of scrutiny on the types of technology police are using, particularly given the RCMP’s power to arrest and detain.

“The Communication Security Establishment, this is a high-tech agency that is very well versed in how to use data and technology,” Luprecht said. “Whereas you might say with the RCMP, that’s not their primary bread and butter, so there’s a much higher risk that the RCMP might make the wrong decision, draw the wrong inferences.”

The committee has the opportunity to decide whether the current laws are sufficient to protect Canadians’ privacy. It could decide the RCMP needs to submit annual reports for further transparency.

Typically, police use of surveillance technology is kept secret, Fraser said, and he would like to see a framework put in place so that new technology has to go through independent scrutiny.

“I have zero comfort in imagining what is the process currently adopted by law enforcement in Canada to determine the appropriateness of the use of certain technologies.”

Brenda McPhail, the director of the Canadian Civil Liberties Association’s privacy, technology and surveillance program, released a statement in late June asking a host of questions about how the technology is being used and why the privacy commissioner was not consulted on its deployment.

“What tools are being used, and who supplies them?” McPhail wrote. “Is it one of the many vendors of spyware known for selling such tools to authoritarian states who use it to target human rights defenders and journalists?”

Fraser said that is another important question for the committee to consider.

“If the police can remotely get into anybody’s smartphone, that means that there’s something defective with that smartphone that the police are exploiting and that bad guys can also exploit,” he said.

The “ethical thing to do” in that case, Fraser said, is for police or spy agencies to report any such loopholes to smartphone makers.

“They’re never going to do that unless they’re told,” he said.

Witnesses appearing during the scheduled two days of hearings include Public Safety Minister Marco Mendicino, the current federal privacy commissioner and his deputy, and RCMP officers who oversaw the use of spyware.