FYI.

This story is over 5 years old.

News

Canadian cops admit to using Stingray devices to track cellphones en masse

Police have been using ISMI catchers for mass cellphone surveillance; civil liberties advocates call the practice "particularly invasive."
Canadian Press

Police in some of Canada's largest cities have admitted to using powerful surveillance tools that indiscriminately hoover up cell phone metadata of people in a given area—even those not under investigation by police—which privacy researchers say is a problem for Canadian civil liberties.

Nearly a year after the RCMP first acknowledged that they owned a number of cell phone surveillance devices, commonly referred to as Stingrays, and that they had been lending them to local police forces, there are still few clues to how often, and where, these devices are being used in Canada. Multiple police forces contacted by VICE News declined to discuss their use of IMSI catchers.

Advertisement

Ottawa’s police force said that it “does not discuss investigative techniques” and encouraged anyone interested to make a freedom of information request.

Carol McIsaac from the Halifax Regional Police said “there is a myriad of investigative techniques available to assist police during investigations, IMSI catchers being one of them,” but that “Halifax Regional Police doesn’t discuss technical equipment and/or its use in a public forum.” A spokesperson for the RCMP said, plainly, that “we probably aren’t going to give you anything.”

Police in London, Ontario denied owning any such surveillance technology while several other forces, including Vancouver police, did not respond to requests for comment from VICE News.

IMSI catchers have been criticized because they don’t target specific suspects, and instead trick every cell phone within range to connect to the device and recording the unique identifier and location of each device on police servers.

'PARTICULARLY INVASIVE'

Brenda McPhail, a privacy expert with the Canadian Civil Liberties Association told VICE News that the use of IMSI catchers is “a particularly private invasive one, and it’s one that the public can reasonably demand some accountability.”

Following a two-year long battle to pry a set of documents free from the hands of the Toronto police, the Toronto Star reported that Toronto police had used an IMSI catcher in at least five different investigations since 2010.

Advertisement

“It’s about time. The concept of it being the worst-kept secret is pretty much right,” said McPhail. What is surprising, she said, is how flagrant their lying to media was.

In 2015, Toronto police claimed: “We do not use the Stingray technology and do not have one of the units.”

“Normally they would at least hedge it. There would usually at least be some weasel language,” said McPhail.

The use of IMSI catchers in Canada is not new information, at least for anyone following along with the story. Last year, the RCMP copped to owning at least ten IMSI catchers. The OPP and the Calgary Police Service also each own at least one device, and the RCMP acknowledged that they do lend their devices out to local police forces from time to time. Police in Winnipeg and Durham, as well as CSIS, have been cleared to purchase similar devices.

Trying to track a cell device is a bit like a game of Operation: In an ideal situation, police are able to home in on the individual device with a high degree of precision, and the tracking is limited to that specific cell phone user. The use of IMSI catchers, on the other hand, is a bit like turning the board upside down, shaking all the pieces loose and sifting through for the one you want.

IMSI catchers don’t necessarily work by targeting single cell phones, but rather by casting a wide ‘spoofing’ net that connects all devices within a given range, meaning that the device metadata of innocent passersby could be, and often is, swept up by the device. (The RCMP has stated publicly that their IMSI catchers only collect metadata, and not the content of communications, and that their devices aren’t actually capable of collecting that data. But the technology to intercept and even suppress communications does exist on the IMSI catcher market.)

Advertisement

'PERSONAL INFORMATION'

For innocent Canadians—people of no interest to law enforcement officers using the device—much of that data remains on a server somewhere. The RCMP, in a briefing last year, suggested that they need to preserve all the data, since it forms part of the evidentiary record. “The data, once it is seized lawfully to the judge, will be secured and locked up for criminal court purposes. It will not be accessed, other than the target information, again,” said the RCMP in a technical briefing in April 2017.

That, says McPhail, should be cause for concern, since it’s not immediately clear what happens to all that extra data that is collected. “It’s about secondary uses, it’s about the safety of all that personal information,” she told VICE News. “Who keeps it, how long it’s stored, whether it’s deleted—there’s no reason why data storage retention and deletion policy couldn’t be released.”

So far, police have almost always been able to conceal the use of IMSI catchers by exempting documentation from access to information laws under the pretense that to reveal their use would render the tool itself less effective.

That’s a claim that Christopher Parsons, a researcher at Citizen Lab, a Toronto-based cyber-security research group, says is pretty flimsy. “We know that the police have a range of different powers—anything from wiretaps to productions orders, and the fact that the public knows about that because there’s legislation on the book doesn’t mean the techniques are any less effective,” Parsons told VICE News. “If you just hide the surveillance tools, it means that Canadians are subject to intrusions on private knowledge that they couldn’t have known about.”

Advertisement

And these are just the devices that Canadians know about. The process of getting law enforcement agencies across the country to admit to owning them is one measured in calendar years; the use of the devices, noted McPhail, is already likely to be out of date. We now know what tools Toronto police were using in 2010, but not necessarily which tools they are using now. “We don’t know, because we don’t have access to the specifications of the tool.”

That is entirely by design. Some manufacturers of similar devices in the United States have included muzzling clauses in their contracts with law enforcement, which prevent those agencies from revealing how the devices work. It’s not clear whether the RCMP has such a contract with the Harris corporation (manufacturers of the Stingray-brand device), because the RCMP will neither confirm nor deny that they own any specific device.

Whether or not police have upgraded their IMSI catcher technology in recent years is unclear—again, no police agencies were willing to discuss their use of the devices. “I mean, it’s human nature. We all do it,” said McPhail. “How often do we upgrade our cellphones? If the tool was useful in 2010, chances are they’ve upgraded it.”

It’s not clear what the relative efficacy of IMSI catchers are, and whether or not they have actually been instrumental in getting convictions. We do know, however, that the use of these devices has caused cases to go spectacularly sideways: In early 2017, the RCMP were so skittish about acknowledging the use of the devices in a Quebec court that 35 alleged associates of the Montreal mafia were allowed to skate on drug, weapons and kidnapping charges. Quebec Superior Court Justice Michael Stober had shot down the Crown’s argument that police could keep their investigative methods secret. (That was one of the first times the RCMP had admitted to having the devices, which led to them coming clean a few weeks later.)

Advertisement

Other effects of the devices are less tangible, but potentially further reaching. Parsons says that Citizen Lab’s research has found that the mere awareness of the use of IMSI catchers can chill political speech. In 2014, Chicago police used an IMSI catcher to monitor Black Lives Matter protesters. “Depending on how and where and when they use these devices, they can chill political speech,” said Parsons.

'TARGETED PERSONS'

Perhaps more concerning is just how accessible these devices are to non-law enforcement individuals. The PKi 1640, an IMSI catcher capable of capturing metadata, monitoring conversations and “suppression of specifically selected conversations of targeted persons,” is available online for about US$1,800. In 2010, researcher Chris Paget built his own system for about $1,500.

“These devices are accessible to the general public, often from shady sellers,” said Parsons. “Certainly the concern is that you could have criminal actors or other state actors, or corporate actors,” using the devices.

(A tangential mystery: in early 2017 CBC Ottawa, working with a security research firm, detected a number of active IMSI catcher devices around Parliament Hill. Nobody has yet owned up to the devices being theirs.)

If any part of the new disclosure is a victory, it’s fair to say it’s a muted one. “I think it’s good that they’re finally admitting it,” said Parsons, “but the release of these documents, to the best of my knowledge, doesn’t undo the decision that was made previously. […] They still have a ruling that has affirmed the argument that any information that could potentially damage an investigation” allows cops to hide the use of these devices.

And there remains just as many questions around the prevalence of the devices in Canadian law enforcement. “There’s so much we don’t know, and it’s not clear why we can’t know,” said McPhail. “At some point there’s questions of public trust. It’s more damaging to the general trust of an organization to be seen as secretive and potentially dishonest with the way these devices are used.”

For the general public, the Kafkaesque reality is that there’s almost nothing that can be done to keep your cell phone from being swept up by an IMSI catcher. “Everyone should be thinking about their personal privacy,” said McPhail. “But that’s not going to protect against technology like Stingrays.”

“The backbone that undergirds the cell infrastructure has to be rebuilt,” said Parsons. More people do more things on their cellphones than they used to, and IMSI catchers are particularly effective devices because of that. As well, the general list towards greater privacy awareness—Parsons singles out the increasing adoption of two-factor authentication—has empowered police to complain that they need stronger tools.

“Right now, the government has provided a relatively tame set of uses for the technology,” he said, “but there’s no reason that they can’t expand quite rapidly.”