Regulate cell surveillance

Finally, the RCMP has admitted what journalists, parliamentarians, privacy watchdogs and democracy advocates have suspected for years. The federal police force has been surreptitiously using spy technology to collect Canadians’ cellular details, including tracking where they are.

As disturbing as that admission is, it’s also a welcome step forward. Now that it’s acknowledged, citizens and parliamentarians can debate — and legislate — how and when the devices should be used. Until now, it’s been the Wild West.

Chief Superintendent Jeff Adam acknowledged last week that the RCMP used the so-called stingrays or “mobile device identifiers” multiple times in 19 cases in 2016 and 24 in 2015

He also made clear that other police forces in the country are using the technology. But it’s still not known how many times it has been used in total.

Adam said the identifiers are used simply to “identify and locate a suspect in a criminal investigation.” But the problem is that the technology doesn’t distinguish between suspects in criminal cases and ordinary citizens.

That has privacy experts worried. Stingrays, which imitate a cellphone tower, act like a “dragnet” that puts the privacy of potentially tens of thousands of innocent, law-abiding people at risk, warns Ann Cavoukian, the director of the Privacy and Big Data Institute at Ryerson University.

Worse, once the “metadata” — information relating to phone numbers, SIM cards or handset identifiers — is collected, it is kept by the RCMP. “Surely the data (that is not needed) should be deleted,” Cavoukian sensibly points out.

That’s how it works elsewhere. In the United States, the government is required to destroy within 48 hours any information obtained through this kind of surveillance that is unrelated to an investigation. Other countries have laws requiring that all citizens whose data has been incidentally caught up in the net must be informed.

Canada has no such protections, since before last week no one had publicly acknowledged that the devices were being used. At this point, Adam said, the RCMP is required to get judicial authorization before using the devices, except in extremely urgent cases to prevent death or imminent harm.

The technology, he said, is used to identify a user’s “basic subscriber information,” such as the name and address connected to the phone. Then police can seek additional warrants to track the device or conduct a wiretap to capture communications.

But here too, Cavoukian suggests, there is a need for independent oversight to ensure the technology (never mind the data that is mined) is not abused.

In addition to privacy concerns, the devices also raise safety issues. Because they mimic cell towers, anyone caught in their zone who is dialing 911 would not be able to get through.

That’s a risk the RCMP has tried to minimize by advising stingray operators to use the devices for only three minutes at a time and to shut them down if they realize anyone is trying to call 911.

Still, there is a danger that something could go horribly wrong in an emergency.

For the police, the privacy downside to using the devices is outweighed by their usefulness. “This capability can be used to further criminal investigations relating to national security, serious organized crime and other serious Criminal Code offences that impact the safety and security of Canadians,” Adam said.

Maybe so, but police should not be given free rein to invade our privacy indiscriminately.

Now that the RCMP has admitted Canadian police forces use these devices, the government must step up to regulate their use and ensure that data gathered from innocent Canadians is destroyed.

Last week, the RCMP finally admitted that it and other police forces in Canada were using spy technology that collects Canadians’ cellular details