Finally. After years of obfuscation, the RCMP have admitted they are using invasive surveillance devices known as IMSI-catchers or Stingrays to spy on Canadians’ cellphones. The admission came early last month, seemingly prompted by revelations from CBC News that Stingray devices had been in use in downtown Ottawa, and at the international airport in Montréal.
In those instances, Public Safety Minister Ralph Goodale issued a strong denial that Canadian agencies, such as the RCMP or CSIS, were involved, but the controversy brought a great deal of public attention to the RCMP’s own use of Stingray devices.
Stingrays are deeply problematic for a number of reasons. About the size of a small suitcase, they operate by mimicking a wireless tower, tricking all cellphones within a radius of up to 2 kilometres into switching their connection to the Stingray. Once that connection is made, instead of targeting just a single device, Stingrays indiscriminately vacuum up sensitive personal information from all devices within range.
This means that Stingrays are essentially a tool of mass surveillance. There’s no need to be a target of a police investigation to have the security of your private information compromised — you just need to be in the wrong place at the wrong time. And when you consider just how many cellphones are located within a 2-kilometre radius of, say, a downtown Toronto intersection, that gives some indication of just how many Canadians have likely been impacted.
Secondly, Stingrays are capable of collecting information on everything from your location to details of every call, email and text you make. They are even capable of listening in and recording the content of cellphone calls. Nor should we be reassured by the RCMP’s statement that they only use Stingrays to collect location and device identification metadata — as Brenda McPhail of the Canadian Civil Liberties Association points out, “Metadata includes location information. That is intimately personal. The fact that they only collect metadata doesn’t let them off the hook.”
For those of us working in the field of digital privacy, the RCMP’s belated admission that it has deployed Stingrays dozens of times in recent years did not exactly come as a surprise — especially after Motherboard and VICE News obtained over 3,000 pages of court documents revealing how the devices were being used, and how few safeguards were involved. Despite media reports such as this, the RCMP has clearly spent years trying to hide its use of Stingrays from the Canadian public, even dropping serious criminal charges to avoid revealing this information.
Hopefully, the RCMP’s long overdue statement will finally prompt the informed democratic debate Canadians deserve about whether the use of these surveillance devices can ever be justified and, if so, what safeguards are necessary to protect the privacy of the law-abiding public.
Unfortunately, the RCMP left many important questions unanswered. Why not tell us how many innocent Canadians have had their private information compromised over the past 10 years? Or let us know whether Stingrays have ever been used to monitor a political protest? And why did the RCMP wait until just a few weeks ago before applying for permission from Innovation, Science, and Economic Development Canada to use the devices?
Last but far from least, the fact that the use of Stingrays can apparently be authorized based merely on suspicion of wrongdoing is hugely worrying — surely a much higher standard of evidence should be required, given the serious privacy implications for the general public?
It’s clear we deserve answers to all these questions from Public Safety Minister Ralph Goodale. Canadians should keep up the pressure on the government by supporting our 48,000-strong campaign at StopStingrays.org
David Christopher is communications manager for OpenMedia, a community-based organization that works to keep the Internet open, affordable, and surveillance-free.