Does Canada permit the export of spyware to repressive military regimes? Ottawa won’t say

Montreal firm is major supplier of controversial phone tracking technology around the world

OTTAWA—In late 2019, two high-ranking Bangladeshi security officials sought approval from their government for a trip to Canada.

One was from the Bangladeshi public security division. The other was an official with the Rapid Action Battalion — a paramilitary force accused of human rights abuses and more than 400 extrajudicial killings since 2015.

According to a document obtained by Privacy International and reviewed by the Star, the two officials intended to stay for a week to inspect new surveillance technology they were considering purchasing from a Canadian firm.

The four backpack-sized cellphone trackers, known as “IMSI catchers” or “stingrays,” would allow Bangladeshi security forces to identify mobile phones and pinpoint their users’ locations.

The controversial technology — which allow what amounts to mass surveillance, according to critics — has been deployed by police forces across the world, including in Canada.

But because of the technology’s potential for abuse, the Canadian government restricts its export. Companies must seek approval from Global Affairs Canada before selling IMSI catchers to other countries.

It’s not known if the two Bangladeshi officials actually made the trip in late 2019 — the country’s high commission denied any knowledge of the visit.

What is known is that around the same time as their scheduled visit, a Montreal-based company sought and received Ottawa’s approval to sell IMSI catchers to a customer in Bangladesh. The company confirmed that Global Affairs Canada approved that request, and the devices were exported.

Meet Octasic, the Canadian company that has become a major player in exporting the surveillance technology to the world.

Sébastien Leblanc acknowledges that the technology is controversial.

“The technology that we develop has multiple benefits … but we fully recognize that there could be some possible abuse of this technology, and we’re taking every step we can to prevent that,” the Octasic chief executive officer told the Star in an exclusive interview, his first public comments about the company’s cellphone tracking technology.

“This industry, there’s a lot of players from various countries that don’t have those high-level standards that Octasic works within,” he said. “We’re trying to be responsive, but at the same time respectful of some confidentiality and sensitivity around this technology.”

Founded during the dot-com boom to sell telecommunications gear, Octasic has grown into a major supplier of IMSI catchers to police and intelligence agencies around the world. (IMSI stands for international mobile subscriber identity.)

According to Leblanc, the company began selling the devices in 2015, just as the world’s main supplier of the surveillance tech — the Harris Corp. — was getting out of the game.

The devices mimic cellphone towers, forcing mobile devices within a certain range to connect to them. Once that’s done, IMSI catchers identify mobile devices within their range and can pinpoint their location. But it’s not just target devices that get caught up in the dragnet — all cellphones within an IMSI catcher’s range are potentially identified. That’s where the mass surveillance criticism comes in.

Some versions of the technology can also intercept text messages, internet traffic and telephone calls.

But Leblanc said Octasic’s brand of IMSI

catchers — known as “Nyxcell” — specifically do not include the ability to intercept targets’ data. Leblanc said the company has “clear guidelines” about what its products can do.

“The intent is really to detect and locate cellular phones, of course used in criminal investigations, but also search and rescue applications, suicide prevention, abductions … That’s really the spirit the company had when entering this market.”

Mike Katz-Lacabe, a researcher with the Centre for Human Rights and Privacy, cast doubt on the assertion that Nyxcell devices can’t intercept communications. Even if the Nyxcell devices’ software isn’t programmed to allow intercepts, Katz-Lacabe said the hardware is capable of that function.

“The hardware certainly can do it — there’s absolutely no doubt about that. The question is whether software has made it so it’s easy to do,” said KatzLacabe.

Katz-Lacabe called Nyxcell a very significant player in the IMSI catcher market for U.S. law enforcement at the state and local levels, although it’s impossible to say how many police agencies use the Nyxcell units. That’s because the use of IMSI catchers in both the U.S. and Canada is shrouded in secrecy.

Toronto police denied for years that they used the technology, before a 2018 Star investigation revealed they had done so in numerous investigations. The CBC revealed in 2017 that the RCMP had used IMSI catchers in investigations across the country.

Octasic doesn’t reference its Nyxcell products online. Interested buyers send inquiries through a website where they are asked to fill out a form, and the company will get back to them.

“(Things) are going to operate much better for them the less information that’s known about this publicly,” KatzLacabe said, “because when most people hear about what this capability is, it can be quite a terrifying thing.

“This gives the police a lot of power.”

Canada’s approval for the export of surveillance technology to Bangladesh is also raising questions about the federal government’s commitment to its international obligations, as well as its export controls.

Siena Anstis, a senior legal adviser at the University of Toronto’s Citizen Lab, noted that Canada is a signatory of the Wassenaar Arrangement, an international treaty that restricts “dual-use” technology like IMSI catchers. The federal government also brought in legislation to join the United Nations Arms Trade Treaty in 2019 — just months before the Bangladeshi delegation sought to test-drive Canadian cellphone tracking technology.

“The timing is pretty important,” Anstis said in a recent interview, referencing Canada’s updated legislation around the UN treaty.

“If this authorization was issued after (that UN arms trade legislation was adopted), then I think it raises questions about how effective the review is of the human rights impact of exports from Canada.

“I mean, I say that, (but) the broader context is Canada continues to export significant amounts of arms to Saudi Arabia. So I think we have to keep in mind that, the commitment is there in writing and it’s there in legislation, but whether the government is doing an actual thorough review of every export for human rights considerations … is an open question.”

Global Affairs Canada, the department responsible for overseeing Canada’s export control regime, would not discuss specific details, citing the need to maintain commercial confidentiality. But the department said “respect for human rights” is central to its approach to export controls.

“Each export permit application is reviewed against the Arms Trade Treaty criteria to determine whether the export could be used to commit or facilitate a serious violation of international humanitarian law or international human rights law, acts of terrorism or transnational organized crime, or serious acts of gender-based violence or violence against women and children,” the department wrote in a statement.

Global Affairs Minister Marc Garneau declined repeated requests for comment. When asked about the political accountability for the decision to export cellphone surveillance technology to

Bangladesh, Garneau’s office said the non-partisan public servants’ statement stood for the Liberal government.

Leblanc said Octasic has applied to the federal government for numerous export permits to sell IMSI catchers worldwide. He would not discuss specific countries or clients, or disclose how many export permits the company had been granted.

According to federal lobbying records, Octasic employed Marc Desmarais, a vice-president at National Public Relations, to meet “with officials from Global Affairs Canada regarding the company’s export permits.”

Desmarais did not respond to the Star’s interview request.

Leblanc said that Global Affairs had refused at least one of the Octasic’s export requests, but said he could not discuss any details.

“Serious questions must be asked of the entire export licensing process in Canada, particularly as other countries have denied the export of the same surveillance tech to Bangladesh,” said Edin Omanovic, the advocacy director of Privacy International.

“Given the seriousness of this, it is a matter of urgency that all such licensing data is made public in order to allow the public and parliamentarians to know the full extent” of Canada’s exports of surveillance technology.

Export permits are not publicly released in Canada. The only way for a member of the public to view them is through the access to information system — a process that takes months or even years, and which censors crucial information from public release.

“There is no good argument for keeping this information from the public,” Omanovic said.