The Royal Canadian Mounted Police has been using mass surveillance devices known as IMSI catchers, in public, for a decade. In that time, the police have indiscriminately surveilled potentially thousands of Canadians without their knowledge, and stored that information for later use.
Motherboard and VICE News obtained more than 3,000 pages of court documents that were produced as part of a case centering around a 2010 RCMP drug bust that unveiled a Montreal mafia slaying, codenamed Project Clemenza. Thanks to these documents, Canadians are finally getting a peek into the RCMP's use of mobile device identifiers—the police's term for IMSI catchers. On Friday, some of the men who pleaded guilty in the case that sprang from Clemenza are being sentenced in a Quebec court.
These documents reveal that the RCMP cut corners in training officers on how to use mass surveillance devices, and routinely surpassed even US federal police in their embrace of the technology by retaining surveillance data after an investigation is concluded.
"Clearly, they've been planning for some time to use them for day-to-day mass policing"
IMSI catchers essentially act like fake cell phone towers. They force every phone within range—which may be up to two kilometres away—to connect and communicate information such as the handset's unique ID, the ID of the phone's SIM card, and its carrier and country of origin. Some IMSI catchers are capable of intercepting texts and phone calls.
IMSI catchers are indiscriminate. They act more like a dragnet than a targeted surveillance tool, and one can imagine how many innocents may be surveilled when an IMSI catcher is deployed in a bustling city centre.
Although the use of IMSI catchers by police in the US is well-known, the RCMP has been remarkably guarded about revealing its capabilities to the public.
"This technology is so privacy-invasive that it is essential we be given enough information to ensure that it is only being used lawfully and with respect for our Charter rights," said Brenda McPhail, director of the Canadian Civil Liberties Association's surveillance project. "Only then can we have a real debate about whether the benefits to public safety are at all proportionate to the profound privacy risks presented by this technology."
In the past decade, as the RCMP has expanded its IMSI catcher program and increased its surveillance capabilities, the federal force has not filed a single privacy assessment to the Office of the Privacy Commissioner, the nation's federal privacy watchdog, a spokesperson for the Commissioner told Motherboard.
Despite efforts on the part of the RCMP and the Crown to suppress information relating to the use of IMSI catchers in Project Clemenza, the documents nonetheless paint the picture of a surveillance program that likely grew too fast for its own good, and raise serious questions about how the police subvert Canadians' privacy.
Extensive redactions in court documents related to the Clemenza case make it somewhat difficult to construct a detailed timeline of the IMSI catcher program, but it's clear that the RCMP's adoption of advanced mass surveillance began years ago. The RCMP's first IMSI catcher was purchased in 2005, according to testimony from RCMP peace officer Jocelyn Fortin. Between 2006 and 2007, officers were trained to operate the devices at so-called "controlled sites." But early use of the surveillance tech wasn't limited to test sites: testimony indicates that the RCMP received permission to use them in public for training purposes.
In 2011, the RCMP purchased another IMSI catcher device, which was delivered in 2012. Officers received an additional three days of vendor training in spring of that year. Some devices may cost anywhere from tens of thousands of dollars to over one hundred thousand dollars.
Fortin testified that in 2014 the RCMP was "good to go" on two more "products." Redactions make it unclear whether the products in question were IMSI catcher devices, but the context of the comments—IMSI catcher procurement—suggest as much.
It's impossible to say how many IMSI catchers the RCMP currently has. However, these documents, which cover events up to mid-2015, paint the picture of a wide-ranging program.
"Our working theory was that originally that these devices were used in limited and extreme cases," said Tamir Israel, a lawyer for the Canadian Internet Policy and Public Interest Clinic (CIPPIC), which is based at the University of Ottawa. "Now, we're seeing them become tools of general use. Clearly, they've been planning for some time to use them for day-to-day mass policing."
Officer Fortin testified that he has personally operated IMSI catchers in "over 30 different operations," and "on over 50 different subjects." Testimony from officer Mark Flynn in 2015 also reveals that, at that time, the RCMP maintained "a large facility" in an undisclosed location for Fortin to "test and determine and how [the IMSI catcher] functions and how to develop the methodologies that [the RCMP] would deploy."
"We know that there are a large number of documents, and they stretch across the RCMP"
Officer Josh Richdale, an IMSI catcher operator, testified that he had 300 working hours operating the equipment in the field, and that he personally has operated an IMSI catcher device at a range of two kilometres.
Richdale also revealed two previously unknown uses of IMSI catchers in Canada.
One was deployed at a range of two kilometres in a rural area near a firing range, although the exact location is unclear. Any cell phones in the area would have been forced to connect to the RCMP's device and send identifying information to the police. In another case, an IMSI catcher was deployed in Toronto to find a missing elderly man who was later discovered dead in a field. Exactly when these events occurred is not known.
"The RCMP possesses and uses specialized tools and techniques under lawful authority in the execution of criminal investigations," RCMP spokesperson Sgt. Harold Pfleiderer told Motherboard in an email. "All our investigative efforts are directed at supporting public safety, [and] are targeted, limited, specific, proportionate and lawfully authorized by an independent judiciary."
But the device used in Project Clemenza was, by definition, not "specific" or "targeted." The IMSI catcher's main function is to scan an area for any phones and collect the device ID, SIM ID, carrier, country of origin, and phone manufacturer. The IMSI catcher does not discriminate between innocent and guilty.
Although the RCMP "avoid" conducting readings while driving or in crowded areas like malls, officer Richdale testified that "that's not to say [the RCMP] wouldn't do a reading in [those] areas."
In the case of Project Clemenza, the defence argued "it is clear that, at times, thousands of innocent third parties" were surreptitiously surveilled by the RCMP. Court filings show that the RCMP deployed IMSI catchers at a range of one kilometre during Project Clemenza. Any phones within that kilometre radius would have had potentially identifying information swept up in the dragnet.
The IMSI catcher used in Project Clemenza did not intercept the content of any communications, but the RCMP's surveillance abilities have grown with the increasing technical capabilities of IMSI catcher devices themselves. Now, some devices are capable of actually intercepting the content of text or voice communications.
According to testimony from peace officer Fortin, the RCMP has obtained more IMSI catcher devices with greater capabilities since Project Clemenza. The nature of these capabilities was not disclosed.
"The RCMP has received numerous requests from the public and journalists about their use of IMSI catchers, and they've routinely refused to produce those documents, or they've claimed they simply don't exist," said Christopher Parsons, a researcher at the University of Toronto-based Citizen Lab.
"We know now that flatly isn't the case. We know that there are a large number of documents, and they stretch across the RCMP."
Court documents reveal not just a large-scale RCMP surveillance program using IMSI catchers, but a program that may have grown too fast for its own good.
Around 2010, according to testimony from peace officer Fortin, the RCMP was losing IMSI catcher operators and taking on new staff at a rapid pace. At this point, Fortin and his skills with IMSI catchers were already being stretched thin by RCMP demand. "I was getting called many times to operate the equipment on different [operations] across the country," Fortin said. "They gave the list [of certified operators] to the different Special 'I' [sections] across the country, that they should call before calling me or calling our office to get an operator for the system."
The demand for resources led the RCMP to take certain shortcuts in training officers to be IMSI catcher operators, these documents show.
According to Fortin, the original round of IMSI catcher operators was given a full week of training on the theory and practice of how to operate these devices. But during Clemenza, the demand for new operators was so high that "we couldn't provide that full week of training" for new employees, he testified. Instead, officers were trained on the job, in the field, and on ride-alongs with fellow officers.
Officers testified that there is no standard for note-taking on the part of operators in the field, and IMSI catcher testing may not have resulted in any formal reports either. This is despite troubling findings, such as the fact that IMSI catchers prevent devices in range from making 911 calls—something that officer Flynn testified was only discovered through the RCMP's own testing.
"Everyone should be seriously concerned about officers who have not received formal classroom training going out and using devices that disrupt the ability of people to make emergency calls," said Christopher Soghoian, the American Civil Liberty Union's chief technologist.
When pressed about the quality of this training, Fortin testified that he didn't "fail" any IMSI catcher operators, and that "when the training is done, everybody is able to operate the equipment." Fortin said that some operators were not up to snuff, but he blamed this on the operators themselves and not their training.
The RCMP also essentially authorized itself to use IMSI catchers during Clemenza, court documents indicate. The RCMP first sought a "general" warrant, officer Richdale testified, which authorized the RCMP to use an IMSI catcher. But it was a senior RCMP Criminal Operations officer who laid out the conditions of the device's deployment. "With his authorization, we would then proceed with the operation," Richdale said.
According to officer Richdale, internal authorization to use an IMSI catcher and the terms of its deployment from a senior RCMP official may even come before a judge issues a general warrant. The RCMP declined to confirm whether this is still the case or not.
"We don't even understand the authority under which these things are authorized, and that strikes me as a very serious problem," said Citizen Lab's Christopher Parsons. "We have to understand the laws that affect us."
When IMSI catcher operators complete a session, all of the data they've just collected from people's phones is stored on USB drives or CDs by the RCMP.
"Once they have that information, they can legally use it in other investigations. It's a tangible threat to the privacy of innocent people down the road"
In one chilling instance, officer Richdale told the court, "If I were to use [an IMSI catcher] in this courtroom and I conducted a reading right now and everyone had a cellular device, [identifying information from] all the cellular devices would be obtained and kept in our database."
The US Department of Homeland Security has a publicly viewable policy that says all IMSI catcher data collected as part of an investigation must be destroyed after the mission is completed, and after the target is located.
"The US government's position is: yes, we technically send these probing signals into private places, but it's not a big deal because we destroy it afterwards," Soghoian said. "The privacy invasion is greater if they hang on to the data."
But the RCMP, in contrast, pushes to retain IMSI catcher information, and requests this ability from the judge issuing the warrant, according to officer Flynn's testimony. "Whenever I hear any suggestion that there should be destruction of information, it bothers me," he said.
When asked if officers are able to search these stored databases, which may contain the personal identifying information of innocent Canadians who are not under active investigation by the police, the RCMP declined to comment.
Officer Richdale testified that the RCMP surveillance unit stores such information but keeps it from investigators. In his words: "We won't destroy it, but we won't disclose it either."
What this means is that, essentially, police can capture your private information, even if you're not under investigation for a crime, and store it in a shadowy database which may be searched later, during unrelated investigations.
"Once they have that information, they can legally use it in other investigations," said Israel, the CIPPIC lawyer. "It's a tangible threat to the privacy of innocent people down the road."
Canadians have only begun to hear about the RCMP's use of IMSI catchers in recent years, and in bits and pieces at that. But the Project Clemenza court filings are now filling out the picture, revealing a large-scale operation that has been growing for over a decade. The documents only stretch to 2015, but there's no reason to believe that these practices have changed since then.
More importantly, the Clemenza files suggest that the RCMP's IMSI catcher program grew rapidly and resulted in improper training of officers, that it established standard practices that encourage internal authorization before a judge's warrant, and that it absolved operators of the responsibility to keep detailed notes after surveilling innocent Canadians.
Police have a job to do—that's beyond dispute. But powerful surveillance technologies, wielded without proper guidelines or oversight, go beyond the pale. Not only have the police been able to surveil innocent Canadians with impunity for more than a decade, but they did so without proper training, and potentially even without clear legal authorization.
The most important question that Canadians can ask themselves and their elected representatives is: how, in our relatively stable Canadian democracy, have the police been able to hide the use of mass surveillance devices from the public for over a decade?
At the very least, the Royal Canadian Mounted Police owes the public an explanation.