This story is over 5 years old.


New Documents Show How Canadian Cops Use Secret Phone Surveillance Technology

VICE News has learned that Canadian police could be jeopardizing public safety by using surveillance technology that can hack your cellphone.
Associated Press/Eugene Hoshiko

New court documents are shedding more light on the controversial use of mobile phone surveillance technology by Canadian police, the second such case to emerge this year.

In the new case, court documents recently filed in a Toronto court show that the Royal Canadian Mounted Police (RCMP) used a device commonly known as a Stingray, or IMSI catcher, during a pair of criminal investigations into organized crime in early 2014. However, lawyers for the accused have argued that police misrepresented the nature of the device when seeking permission for its use by failing to disclose its range, its ability to pinpoint the location of phones, and potential for interference with 911 calls.


In a hearing that was originally slated for Tuesday — but postponed — the defense will seek more information about the IMSI catcher's capabilities and operating manual, the device's effect on non-targeted phones, and a copy of the non-disclosure agreement (NDA) between the RCMP and the device's manufacturer.

Related: Canadian Police Obtained BlackBerry's Global Decryption Key

Notably, crown lawyers have argued the NDA prevents the RCMP from disclosing further information about the device, its capabilities, and how it used. "This is despite the fact that the agreement in place — likely akin to the ones in place with American law enforcement agencies — is almost surely unconstitutional," the defence lawyers write.

The existence of the highly secretive technique has been known in the US for years, but Canadian police have attempted to keep details about the technique secret. It is only in the past few months that information detailing the use of IMSI catchers by police in Canada has come to light.

The RCMP have frequently been in court in recent years, fighting to keep a lid on its high-level surveillance tactics. Last month, VICE News revealed details of how the police agency obtained the global encryption key for all consumer-grade BlackBerry phones, and used it to bust a mafia murder plot in Montreal.

An IMSI catcher works by disguising itself as a cell phone tower, and forcing all phones in its range to to disconnect from legitimate towers and connect to the imitation tower instead. Police can take advantage of this temporary connection to collect information about nearby phones, track the movements of certain devices over time, intercept communications, and even create and send messages from the target phone, depending on the model of IMSI catcher used.


Watch the VICE News documentary, Phone Hackers: Britain's Secret Surveillance:

The devices are often criticized by privacy advocates for their dragnet-style approach of collecting information, in which information on all devices in the IMSI catcher's range is indiscriminately swept up.

The RCMP have used "several iterations" of such equipment since 2002, the documents show, but the technique was only made public for the first time during a recent court case in Montreal that concluded this past March.

In the Montreal case, the six accused ultimately pleaded guilty to lesser charges, effectively preventing the disclosure of further information about the technique. However, the Montreal case's sudden conclusion has opened the door for defence lawyers in the Ontario case to ask that Justice Michael Code compel the RCMP to disclose more information pertaining to the technique.

Related: DC Police, the FBI, and Their Secret Agreement to Hide Cell Phone Spying

The defence is arguing that police misrepresented the nature of the device when seeking authorization for its use. They allege that the RCMP never disclosed that the Stingray could be used "to locate a specific phone with precision" — information that was only disclosed to the defense in March — and that the authorizing judge was not made aware of the IMSI catchers' threat to public safety, because it can potentially interfere with 911 calls.


They also allege that police never disclosed the device's range, which meant the authorizing judge had no idea how many potential phones might be disrupted when the device was in use. Logs disclosed by the RCMP show hundreds of phones and mobile devices were identified by the device in a matter of seconds.

According to RCMP guidelines disclosed in court, police are are only supposed to be operate Stingrays for three minutes at a time, with a two minute cool-off period before they are used on the same frequency again, in order to minimize the collection of non-targeted data and interference with 911 calls.

However, logs provided by the RCMP showed that police routinely operated its IMSI catcher for longer than its stated guidelines. The defence identified 43 instances based on RCMP logs in which the IMSI catcher was operated for more than three minutes — up to 15 minutes in one case.

It remains unclear how, for over a decade, the RCMP have used IMSI catchers in Canada while in violation of the country's wireless spectrum laws. Under the Radiocommunication Act, any person found to have purchased, imported or used an IMSI catcher in Canada could be fined up to $25,000. For organizations, there are fines of up to $10-million.

Innovation, Science and Economic Development Canada, the government agency that oversees the country's wireless spectrum, told The Globe and Mail earlier this year that it had never authorized an IMSI catcher for use in Canada.