by An admission by Canada’s national police force that it routinely uses powerful spyware to surveil citizens has raised concerns from experts, who warn the country is “asleep at the wheel” when it comes to regulating and controlling the use of technology.
During a parliamentary session in late June, the Royal Canadian Mounted Police presented a document outlining how a special investigative team covertly infiltrates Canadians’ mobile devices. The tools, which have been used in at least 10 investigations between 2018 and 2020, give police access to text messages, email, photos, videos, audio files, calendar entries and financial records. The software can also remotely turn on the camera and microphone of a suspect’s phone or laptop.
The RCMP, which has long dodged questions about whether it uses spyware to track Canadians, provided information about its “on-device investigative tools” in response to a question from a Conservative lawmaker about how the federal government collects data on its citizens.
Related: ‘Game of cat and mouse’: how Citizen Lab highlighted the Israeli spyware firm
Ron Deibert, a professor of political science at the University of Toronto and director of the Citizen Lab, said spyware, which gives police an “extraordinary window into every aspect of someone’s personal life,” is akin to “technology nuclear level,” but has little government oversight.
“There is a culture of secrecy that pervades the intelligence and law enforcement community in this country,” he said.
Deibert, one of the world’s leading experts on surveillance techniques used by authoritarian regimes, said he and others have long suspected police and government agencies in Canada were using the technology. But absent from the disclosure was any indication of who the government is buying the software from.
“That’s my biggest unanswered question,” he said. “Because we know there are some companies that are horrible when it comes to due diligence and routinely sell to governments that use it for grotesque human rights violations.”
Last year, a collaborative investigation between The Guardian and other major international media outlets, called the Pegasus Project, revealed that spyware licensed from the Israeli firm NSO Group had been used to hack smartphones belonging to journalists, lawyers and human rights activists.
In 2021, the US Department of Commerce announced that it had placed mercenary spyware companies like NSO on the Nation’s Entity List, effectively blacklisting them for their “malicious cyber activities” amid growing concern from users. US officials that the software posed a serious national security risk. .
By contrast, Canadian authorities have shown little interest in taking similar steps, said Deibert, who has briefed senior Canadian officials within successive governments.
“Developing export controls and putting more transparency and accountability around procurement practice is a no-brainer,” he said.
The RCMP says that it only uses the tools when less intrusive means have failed. In the document, the police force claims it needs to use spyware because new technologies, such as end-to-end encryption, make it “exponentially more difficult for the RCMP to conduct court-authorized electronic surveillance.”
But privacy advocates disagree.
“The creation of the ‘police investigations go dark’ metaphor due to technological advances is the public relations coup of the 21st century,” said Brenda McPhail, director of the Canadian Association of Privacy Technology and Surveillance Program. of Civil Liberties. “The case has not been made public for the use of this powerful spyware, particularly given the deeply dangerous uses of this technology around the world.”
Related: Vancouver police confirm use of ‘stingray’ surveillance technology
McPhail points to past instances where the RCMP has been evasive and misleading about the technology it uses for surveillance, including a recent controversy over mobile device identifiers, known as IMSI catchers or stingrays. In September 2017, Canada’s privacy commissioner found that the police agency had broken the law six times when it used the technology.
“The policy has been, we are going to do what we can and in secret. If it does come out, then we’ll see what we can do to mitigate the damage,” McPhail said.
In the parliamentary document, the RCMP says it did not consult the federal privacy commissioner before using the technology, but said it nonetheless needs a judge’s approval when monitoring Canadians.
The latest revelations about policing power once again highlight the need for a debate about the “accountability crisis” in law enforcement, McPhail said.
“We need to have a conversation about what kinds of surveillance technologies — invasive tools that are used without any evidence of due process or due consideration for people’s rights and freedoms — are acceptable in a democracy and under what conditions. And we also need to determine what kind of safeguards should be in place.”
Plans to modernize the Privacy Act in the coming months give lawmakers a window of opportunity to adopt the right legislative framework to ensure police have access to the tools they need for investigative work, McPhail said, and not broad powers “shrouded in secrecy” and no public. responsibility.
“The devices we get our hands on are generally designed to extract as much personal information as possible,” Deibert said. But a documented history of police abuse of surveillance tools in the country means recent admissions of mercenary spyware use should be enough to trigger an investigation into whether adequate oversight is in place to prevent abuse, he added.
“Private companies and banks presumably know a lot about your preferences, but only the government can take away your freedom and put you in jail. Only the government can end your life in some jurisdictions,” he said. “This is why there should be a higher threshold for public accountability and transparency when these tools are used by state agencies.”
