Police have been secretly using these machines - known as a Stingray, IMSI catcher or mobile device identified - for years.The Associated Press
Police in Canada who operate sweeping surveillance devices that target mobile phones are breaking the law, according to lawyers acting for dozens of crime suspects.
Defence lawyers for about 40 people charged as gang members and associates in a 2014 Toronto police operation are hoping to put such technology on trial and prove their clients' rights were violated by unlawful surveillance.
In pretrial documents filed in Ontario Superior Court, the lawyers cite a recently revealed RCMP internal memo from 2011 that spells out how police are to use such devices in Canada. The memo was disclosed to the defence in the two-year-old case after The Globe and Mail reported on it in April.
The controversial machine, controlled by Canada's national police force and lent to its municipal counterparts, is variously known as a Stingray, IMSI catcher or a mobile device identifier.
In the 2014 case, a Toronto detective probing a street gang known as the Asian Assassinz swore a search-warrant affidavit that persuaded a judge to allow detectives to bring in an RCMP expert with one of the devices.
Police have been secretly using these machines for years, but only one other case has ever been publicly revealed in Canada.
The investigative tool mimics a cellphone tower. It captures identifying data associated with all mobile phones in an area, which police search in an attempt to zero in on suspects' phones. By its very nature, the device is run at the risk of offending laws that govern privacy and the public air-waves.
Yet, Canadian police have been escaping criticism by saying as little as possible about the machines. In December, for example, a Toronto police spokesman told the Toronto Star: "We do not use the Stingray technology and do not have one." The statement glossed over the fact that the Toronto force had just called in a Mountie to operate one such device on its behalf.
In a factum filed in the Asian Assassinz case earlier this month, defence lawyers Craig Bottomley and Doug Usher say the police reticence speaks volumes. "Canadian law enforcement has been using Stingray devices for well over a decade, and it is only in the last few months that any information surrounding the devices has been coming to light," their argument reads.
Privy to some police disclosure but fighting for much more, the lawyers reveal that the Mounties have signed non-disclosure agreements (NDAs) with machine vendors. According to the filings, RCMP Sergeant Michael Roach told the defence team that Canadian police are "currently bound by a NDA in place between RCMP and the [device] manufacturer."
Whether such corporate secrecy can survive a court challenge is very much in question. Police privilege is restricted in Canada, but a 25-year-old Supreme Court of Canada ruling obliges police to disclose any potentially relevant evidence to the accused. A non-disclosure agreement "is almost surely unconstitutional," the defence lawyers say in their filings.
Under the federal Radiocommunications Act, using an unregistered device that interferes with the public air-waves can bring a prison sentence. And, warrants or not, police officers using Stingray-type devices in Canada are not exempted.
The RCMP anticipated such issues. The 2011 memo issued by Mountie headquarters ordered detectives in the field to run their machines for only three minutes at a time, and then pause for a couple of minutes. This was meant to achieve three things – satisfy judges from whom they were seeking warrants that an invasive technology was being minimized; limit the chance of Stingrays interfering with 911 calls; and to keep police clear of the radio law.
Yet the defence lawyers say police are failing to adhere to their own three-minute rule. As proof, they highlight disclosed logs of devices used in the case that show police sometimes ran them for more than 10 minutes at a time.
In a sworn statement provided to the defence, the RCMP's Sgt. Roach argues police still technically lived up to the rules, because every three minutes the operator would switch to air-wave bands controlled by a different corporation. Or as he put it, "any devices affected during the 'Rogers' phase of collection will not be affected during the 'Bell' phase." In that way, he said, "this process ensures that no one device is affected for more than three minutes."
Upcoming court hearings will settle the issue of lawfulness, but defence lawyers have signalled they still disagree.
"The RCMP breached the Radio-communications act by purchasing, importing and using the Stingray device without lawful authority," the filings says. They add that "if it was the intention of the police to leave the Stingray running and leap from frequency to frequency, this should have been plainly stated to the issuing justice" during warrant applications.
How the RCMP's secret surveillance tools work
RCMP documents disclosed in a recent trial acknowledge that portable surveillance devices, used to target crime suspects, directly impact "innocent third parties" within range — including people dialling 911.
The devices, known as IMSI catchers, mimic cellphone towers and are capable of extracting key identifiers such as the International Mobile Subscriber Identity (IMSI) from nearby GSM phones.
MURAT YÜKSELIR/THE GLOBE AND MAIL
1 A police team turns on its device causing radio waves to emit from an unmarked police vehicle. The machine beckons to phones suggesting it is the strongest cellphone tower in the area.
2 It’s a “hit” – the targeted person’s phone automatically redirects its signal to the police device.
3 The suspect’s phone has unique digital identifiers that are pulled into a database – as are those of phones belonging to innocent third parties. Police can later try to bug the target phone.
4 The police devices can have the side effect of temporarily blocking all new calls – and while 911 calls are supposed to override the interference, up to half the time this does not happen.