RCMP spyware tools are ‘extremely intrusive’, privacy experts say


Privacy and civil liberties experts raise concerns about the RCMP’s years-long use of spyware in major investigations, saying previously undisclosed tools are “extremely intrusive” and calling for stronger oversight and regulation of the software spy across Canada.

Experts also criticized the RCMP’s belated disclosure of its use of these tools, with the Canadian Civil Liberties Association (CCLA) saying it is part of “a pattern pointing to an accountability crisis.”

Canada’s former privacy commissioner, Daniel Therrien, said that while he believes the RCMP says the use of spyware is legal and justified, “there is no question” that the covert collection of personal and other information by part of the police devices of the Canadians “is extremely intrusive.” practice.”

“What is at stake is the balance between privacy and other public interests,” Therrien said Tuesday during his testimony before the House of Commons Ethics, Privacy and Access to Information Committee as part of its study into the RCMP’s use of “on-device investigative tools”. , “or ODIT.

“There’s no question that this particular tool is extremely intrusive, more intrusive than traditional wiretapping tools. It doesn’t just record communications on the phone between Person A and B. It’s on the phone, on the digital device of the individual”. he said.

Given this, Therrien said “there has to be an extremely compelling public interest to justify the state being able to have that kind of information and use these tools.”

The committee launched the special summer study to further explore the RCMP’s use of these tools, after papers filed in the House of Commons in June shed new light on the RCMP’s covert installation of spyware. police force capable of remotely accessing cell phones and computer microphones, cameras, as well as other information on suspects’ devices.

“The revelations about ODITs are just the latest in a series of similar media-led revelations about invasive techniques… This is not an isolated issue,” CCLA Director of Privacy Technology and Surveillance Program told MPs. , Brenda McPhail.

“Operative secrecy is a legitimate need in specific investigations. Secrecy around policies that apply to categories of dangerous surveillance technologies is not legitimate in a democracy. We must not allow law enforcement agencies to combine with each other to avoid accountability,” McPhail said.


Throughout the study, MPs have tried to clarify that the RCMP’s use of these tools is limited and not for “mass surveillance”, although in their testimony on Tuesday afternoon, the experts sounded alarm bells about the possible widespread accessibility of spyware.

“The mercenary spyware industry is grossly poorly regulated and proliferates rapidly. The industry lacks public accountability and transparency. It thrives in the shadows of the underground world and is spreading rapidly without proper controls,” said the director of the Citizen Lab of the University of Toronto, Ronald Deibert. parliamentarians

Deibert said that the spyware industry is a threat to civil society, human rights and democracy in general.

Therefore, he said Canada should take the threat seriously by imposing more oversight and export controls, and being more transparent about the use of spyware to ensure it is not abused, as its capabilities far exceed traditional wiretapping. .

“There is a pattern of law enforcement in this country that uses investigative techniques and surveillance technologies, and reveals them after the fact. That is not the way you build public trust in law enforcement… We are better than that,” he said.

While the courts do have a judicial oversight role, Therrien suggests there could also be an additional layer of privacy-focused oversight by a body, such as Canada’s Office of the Privacy Commissioner.

“I don’t think the RCMP is a rogue institution. And currently, they say, and I accept that they use ODIT only with judicial authorization… That being said, it might be a good idea to have auditing processes,” Therrien said.


To date, the RCMP has not consulted with the Canadian Privacy Commissioner regarding the use of spyware by the Technical Investigative Services Covert Access and Interception Team. Privacy Commissioner Phillippe Dufresne says there are plans for a briefing scheduled for later this month.

Therrien, who was Canada’s privacy commissioner from 2014 to 2022, told lawmakers on Tuesday, like his successor, that he also learned about spyware use at the same time as the rest of the country.

The former privacy watchdog said it was “shocked by the tool itself, how intrusive it is and that I’ve used it for so long.”

“It’s the inclusiveness of the tool that surprised me, not the fact that the state would use the technology in the context of investigations,” Therrien said.

Therrien added that he was also surprised that, given years of public debate over legal access and encryption, the RCMP did not inform him, in his capacity as privacy commissioner, about his ability to use spyware tools.

Canada Privacy and Access Council Chair Sharon Polsky told MPs on Tuesday that she agrees it is problematic that the RCMP has not collaborated with the privacy commissioner, even though there is no legal requirement to do so. do it.

“It’s only after they get caught red-handed in the cookie jar. I think they are doing themselves, themselves and all law enforcement agencies across the country a disservice, a disservice when they are not forthcoming,” he said in response to a question from the Conservative MP and committee member. Damien Kurek on Tuesday.

“It also puts them on the defensive instead of coming forward and saying, ‘We need to use this type of tool’… Help educate the public on why you need this particular type of tool. Don’t wait for them to put you on a hot seat.” Polky said.


Tuesday’s hearings follow hours of testimony Monday from Public Safety Minister Marco Mendicino, senior RCMP officials and Canada’s privacy commissioner.

During those hearings, it was revealed that the RCMP has been using spyware for years longer and in larger criminal investigations than previously reported to Parliament.

The minister and senior officials sought to emphasize to MPs how these encryption circumvention tools are used very rarely, in a specific way that respects the Charter, in a limited number of types of investigations such as terrorism and organized crime, and only in court cases. authorization issued after demonstrating a high threshold of probable cause.

According to RCMP Commissioner Brenda Lucki, the RCMP has used ODIT in 32 investigations to target 49 devices since 2017. However, RCMP Assistant Commissioner Mark Flynn told committee members Monday that the RCMP has been using technology with similar capabilities dating back to the early 2000s

As part of its work, the committee has requested the RCMP to provide a list of obtained arrest warrants as well as other information related to the use of spyware, however, this request has been met with resistance from the RCMP. This has prompted the committee to explore its options for obtaining more information in an appropriate setting, such as an on-chamber meeting or through redacted documents.

On Tuesday, Therrien told MPs from his years of experience pushing to update Canada’s Privacy Act that “in order to come to the conclusion that we need legislative change, we would first need to know how the privacy laws have been applied.” current provisions and test if there should be no concern”.

Additionally, the RCMP has declined to provide details on what specific software is being used, citing “the need to safeguard the ability to effectively use investigative tools on the device.” While the government confirmed on Monday that it is not the controversial software developed by the Israeli company NSO Group called Pegasus, MPs have questioned why the name of the vendor or vendors used by the RCMP is being withheld.

“It’s hard to imagine how a supplier’s name would undermine national security,” Liberal MP Nathaniel Erskine-Smith said during the first of two meetings on Tuesday.

“There’s absolutely no reason why that shouldn’t be revealed, and there are plenty of good reasons to do so,” Deibert said.

While some committee members have expressed a desire to extend their investigation, no further public meetings to hear witnesses have been scheduled as part of this study. When the committee initially agreed to take on this special summer study, the goal was to finalize the report, with possible recommendations for changes to Canada’s privacy laws or oversight mechanisms, as some witnesses suggested, before the start of the fall. seated, on September 19.

Leave a Comment