The RCMP Has Been Using Surveillance Gear Under an 'Interim' Policy for 6 Years

The Royal Canadian Mounted Police, the country's federal police force, has been using dragnet-style cell phone spy tools known as IMSI-catchers, or Stingrays, for more than a decade. After all that time, a new report from Canada's top privacy watchdog reveals, the force is still scrambling to enact a permanent policy governing their deployment.

The RCMP is using these potentially invasive tools under an internal "interim" policy that's been in place for six years, the report from the Office of the Privacy Commissioner (OPC) states. The force procured its first IMSI-catcher in 2005, and its deployment was carried out under a "framework," an RCMP spokesperson told Motherboard in an email, that was further formalized with the interim policy in 2011. The RCMP is only now seeking to update it. "Despite its interim nature, the policy is still in effect today," the OPC report states.

Read More: The RCMP Surveilled Thousands of Innocent Canadians for a Decade

The last two years have seen unprecedented disclosures from police in Canada on their use of IMSI-catchers in the country, and now police forces across the nation—including the RCMP—are scrambling to obtain the proper approvals.

The OPC investigation, which was made public on Thursday, was spurred by a 2015 complaint from Laura Tribe, executive director of Canadian media advocacy group OpenMedia.

"We've seen for years a great deal of secrecy around how these devices are used," Tribe said in a phone call. "It's really encouraging to see that the RCMP is finally looking to implement a new policy, and we're hoping they will proactively release it [to the public]. It's taken years of public pressure for the RCMP to even realize this is a problem—six years of an interim policy doesn't seem very interim."

IMSI-catchers are essentially fake cell phone towers. They are tools of indiscriminate surveillance, and capture potentially identifying details from any phone within the radius of deployment, which may be up to two kilometres in range. If an IMSI-catcher is deployed in a city centre or other densely populated area, device operators could potentially collect information from thousands of innocent people during an investigation.

Even with a new, permanent policy governing the use of IMSI-catchers, it's still a problem that the RCMP is making rules "for the RCMP, by the RCMP," as Tribe said. Opaque internal approvals allowed an illegal spy program to flourish inside another agency, the Canadian Security Intelligence Service, for years. That one collected and retained internet metadata from people not under investigation.

Read More: Local Police In Canada Used 'Stingray' Surveillance Device Without a Warrant

According to the OPC report, the RCMP has deployed IMSI-catchers a total of 126 times in the past five years, 29 of which were in support of other Canadian law enforcement agencies. In six cases, no warrant or judicial authorization were obtained by the RCMP and no life-threatening "exigent circumstances" (such as a kidnapping) were present. For a period in 2015, the report states, the RCMP believed that it did not need a warrant to deploy IMSI-catchers. A statement released by the RCMP on Wednesday states that the force now requires judicial authorization to deploy IMSI-catchers, unless exigent circumstances are present.

"Even with their interim, and shifting, internal policies, we've already seen the challenges of relying on self-governance," Tribe said.

The RCMP declined to describe the details of the current "interim" policy to Motherboard, but noted that only "minor changes" are expected to be made once a new policy is finalized. The force provided the OPC with a draft copy of its new policy, which states that data collected from innocent people may be kept by the RCMP, but not shared with investigators. In addition, the draft policy states that an audit must be conducted "at least once yearly" to ensure that data collected from third parties is destroyed if it is no longer relevant to a case.

The OPC, in its report, recommended that the RCMP ramp up its efforts to be more transparent with the public regarding its use of these controversial surveillance devices. One can only hope that the force follows this recommendation so that next time, a two-year investigation into their practices isn't necessary.

Get six of our favorite Motherboard stories every day by signing up for our newsletter.