Canadian Cops Can Still Use an Unconstitutional Mass Surveillance Tactic to Grab Your Cell Data

An Ontario judge chided Canada's cops for indiscriminately collecting cell phone records on tens of thousands of innocent Canadians on Thursday.

The practise of collecting Canadians' cell phone records in bulk is unconstitutional in its present form, ruled Justice John Sproat on Thursday. Those so-called "tower dumps," however, won't be stopping anytime soon.

Two Canadian telecommunications giants have been fighting the government in court, pushing back against what they call "overbroad and unreasonable" orders to hand over information on scores of their customers.

Those orders can require these telecommunication companies — in this case, Rogers and Telus — to hand over details of every phone call, text message, and piece of data that goes through their cell phone towers.

Rogers and Telus challenged the orders after Ontario police slapped them with a warrant to turn over information on tens of thousands of subscribers during an investigation into a string of jewelry store robberies.

The police gave the companies the geographic coordinates of the jewelry stores, and a timeframe. Rogers and Telus were expected to pull the records of every customer who used their cell phones in that area, during that period, and hand over their names, phone numbers, and credit card information, as well as the information about who they were contacting.

Between the two companies, they say they were being asked to turn over information on roughly 43,000 customers. The request was ultimately withdrawn, but the telecommunications giants continued the constitutional challenge against the general practise, which is employed by police forces across the country."

This is just one of thousands of similar requests, say the cell phone companies, but this may be the largest.

Related: VICE News Investigation Finds Signs of Secret Phone Surveillance Across London

Police use this data to cross-reference cell phones that were nearby more than one crime scene in order to narrow down a pool of suspects.

Police requested data from several other towers nearby, as cell phones do not always access the nearest cell tower — a fact popularized by the true crime podcast Serial.

Sproat raised the serious privacy concerns that underlines the challenge: do Canadians have a right to privacy when they contact their divorce lawyer? A suicide hotline? A business competitor? What if the person's location was a private matter, he writes, "was the person at the Blue Jays game instead of work?"

In the end, Sproat agreed with the two cell phone companies: collecting information on tens of thousands of people, "99.9%" of whom are innocent, is unconstitutional.

But Sproat didn't kibosh the tower dumps outright. Instead, he offered non-mandatory guidelines for police.

In the future, Sproat suggested police should have to tighten their requests to cell phone companies, asking for information that more specifically targets possible suspects and does not create a dragnet for thousands of people.

He further suggested that police should offer clear justifications for the information they're seeking, and never end up with more data than is reasonable, given their search.

While the ruling now offers a more clear way for telecommunication companies to challenge these orders, and a checklist for judges to consult when they approve these sorts of orders, it does not create any strict requirements for how police conduct tower dumps.

While it might not have been a clear win for Canadians' privacy rights, digital advocacy group OpenMedia lauded the decision.

"This is a critical ruling that will help safeguard the privacy rights of countless Canadians," said Laura Tribe, the group's digital rights specialist. "These tower dumps reveal that authorities are really pushing the limits when it comes to warrantless access to our private information. Our cell phone data says a lot about us — and this is an important step to ensuring that authorities are forced to demonstrate just cause for these kinds of requests."

This case is a rare circumstance where telecommunication companies are the ones fighting for their subscribers privacy rights.

Up until quite recently, companies like Rogers and Telus were forking over troves of personal information on Canadians, often without a warrant.

When the Supreme Court of Canada, by and large, put a stop to that practise, a culture shift in the industry led to most of Canada's telecommunications companies issuing transparency reports that detailed how often police requested Canadians' data — and, more importantly, how often they passed it along.

Previous VICE investigations have revealed how much police pay in order to obtain Canadians' private data from private companies, the sort of technology they use to grab that data, and how they steal information directly from the technology infrastructure.

Follow Justin Ling on Twitter: @justin_ling

Photo via Flickr