In 2016, Motherboard used public records requests to receive 3,000 pages of documents from the Royal Canadian Mounted Police detailing the federal police agency's longstanding secret use of IMSI Catchers (AKA "Stingrays" — the fake cellular towers that silently capture data on every cellphone user in range).
The records revealed that the Mounties used Stingrays to surveil regions up to 2km in radius, and indefinitely retained the data they gathered.
The revelations gave urgency to an inquiry by the Office of the Privacy Commissioner (OPC), which has now reported in.
The OPC reports that the policy "framework" the RCMP used to collect cellular data was first drafted in 2005, then formalised as an "interim policy" in 2011. It was never made into a permanent policy — a procedure that may have invited public scrutiny and embarrassing questions about the Mounties' mass-spying.
According to the OPC report, the RCMP has deployed IMSI-catchers a total of 126 times in the past five years, 29 of which were in support of other Canadian law enforcement agencies. In six cases, no warrant or judicial authorization were obtained by the RCMP and no life-threatening "exigent circumstances" (such as a kidnapping) were present. For a period in 2015, the report states, the RCMP believed that it did not need a warrant to deploy IMSI-catchers. A statement released by the RCMP on Wednesday states that the force now requires judicial authorization to deploy IMSI-catchers, unless exigent circumstances are present."Even with their interim, and shifting, internal policies, we've already seen the challenges of relying on self-governance," Tribe said.
The RCMP declined to describe the details of the current "interim" policy to Motherboard, but noted that only "minor changes" are expected to be made once a new policy is finalized. The force provided the OPC with a draft copy of its new policy, which states that data collected from innocent people may be kept by the RCMP, but not shared with investigators. In addition, the draft policy states that an audit must be conducted "at least once yearly" to ensure that data collected from third parties is destroyed if it is no longer relevant to a case.
The RCMP Has Been Using Surveillance Gear Under an 'Interim' Policy for 6 Years
[Jordan Pearson/Motherboard]
(Images: Mountie in Banff, Alberta, HordeFTL, PD; Cell-Tower, J.smith, CC-BY-SA)
