RCMP acknowledges using controversial spy tech to track cellphone data

The RCMP confirmed Wednesday what civil liberties groups say has been an open secret for them for some time: that the Mounties use so-called mobile device identifiers, also known as Stingrays, to identify and locate cellphones.

In a rare disclosure of police tactics, the national police force acknowledged in a statement that it used the technology 19 times last year, but insisted that it did so in compliance with the law and with judicial authorization.

The Mounties say the devices can identify and locate cellular devices, such as a mobile phone, enabling police to identify and apprehend a criminal suspect or locate a missing person.

The RCMP does not intercept phone calls, email or text messages, contact lists, images, encryption keys or basic subscriber information, the statement said.

The disclosure, a rarity for the RCMP, followed a CBC report that someone in downtown Ottawa has been using a device known as an "IMSI catcher," which can intercept and identify cellphone metadata.

The CBC report found the device being used in recent months in close proximity to Parliament Hill and the U.S. and Israeli embassies, among other locations.

Brenda McPhail of the Canadian Civil Liberties Association said the technology casts far too broad a net to be used by police, since it captures the data of innocent people who might be in range of the device.

The federal privacy commissioner's office acknowledged Wednesday that it is investigating the use of the IMSI devices following a complaint by OpenMedia, a self-described crowd-sourced civic engagement platform for the Internet community.

The technology works by momentarily connecting to cellphones in its immediate proximity, before returning them to their own networks. It collects metadata associated with the phones, allowing the operator to identify the phone used by the suspect.

"There are a limited number of authorized and trained RCMP operators who can use MDI technology and its use is subject to very strict rules, senior management approval and judicial authorization prior to deployment," the RCMP statement said.

Except for cases where there is an immediate threat of death or serious harm, police must obtain warrants to use the devices, it added.

McPhail, the association's director of privacy, technology and surveillance, said the RCMP has long refused to confirm or deny that it used Stingrays.

"These devices are not about targeted surveillance, they're indiscriminate," McPhail said.

"They mimic a cellphone tower and they scoop up the data of everybody who has an active cellphone in a large area. In order to find the information of one suspect or a small group of suspects, you're capturing the information of thousands of innocent bystanders at the same time. So it's a dragnet."

She said since the Mounties refused to admit they used the technology, there was no way to discuss the implications.

"Canadians have a right to know when it comes to invasive surveillance technologies not only that they're being used, but that they're being used lawfully," McPhail said.

Added Laura Tribe, executive director of OpenMedia: "Now that the RCMP has come clean, can we finally have the public debate about privacy and accountability that Canadians deserve?"