Details around controversial surveillance unknown

How widely police in Ontario utilize controversial surveillance techniques that can capture private data from large numbers of non-targets in a criminal investigation is unknown, because there are no formal requirements to make the data public.

Police in the province also appear unwilling to provide many details about the use of these techniques, which is a cause for concern, say privacy advocates and criminal defence lawyers.

Law Times submitted questions to the Ontario Provincial Police and police services in Ottawa, Toronto, Peel, York and Durham regions, asking how many “tower dump” production orders were obtained in 2015 and 2016.

They were also asked to disclose how often International Mobile Subscriber Identity catchers (often referred to by the brand name Stingray) were utilized in that time period, as well as policies related to the collection and retention of non-target data.

Tower dump orders require service providers to disclose the names and addresses of subscribers, call data and location for everyone who used a mobile device near a specific cell tower during a certain time period. IMSI-catchers spoof cell towers and capture the unique identifier of every mobile phone in the area, collecting meta-data from subscribers while the device is in use.

Peel and Durham police did not respond to any questions. Police in York region said it would require a manual search of its records management system to find out how many tower dump orders were granted.

The OPP said it does not keep specific records on production orders, while Ottawa police require a freedom of information request to be filed.

In response to questions about IMSI-catchers, Ottawa police said “it did not use or cause to be used” the device in 2015 and 2016.

A spokesman for York Regional Police indicated that it does not “own” an IMSI-catcher.

The number of IMSI-catchers it owns or how often they were used cannot be disclosed because it could “jeopardize active investigations and threaten public and officer safety,” said a spokeswoman for the OPP. Data from non-targets is destroyed after the end of all court proceedings, including appeals.

Mark Pugash, director of communications for the Toronto police, says it does not discuss the use of specific tools or techniques.

“We comply with all reporting requirements,” he adds.

Unlike other surveillance techniques such as wiretap requests, though, police are not compelled to report publicly how often tower dumps or IMSI-catchers are used. It has also been left to police to decide what type of warrant, if any, is required.

“There are no rules,” suggests Craig Bottomley, a defence lawyer who acted in a case last year where the court heard that an IMSI-catcher owned by the RCMP was utilized to assist the Toronto police in its investigation. In cross-examination, an RCMP officer admitted that some of its own policies regarding its use were not followed.

“We need to take more steps to safeguard privacy,” says Bottomley.

The Information and Privacy Commissioner of Ontario would also like to see more information disclosed about how often devices such as IMSI-catchers are utilized and what happens to data collected from non-targets. 

“Police should be open about the use of surveillance technologies,” says David Goodis, an assistant commissioner of the provincial agency.

“The meta-data that these things collect is personal information. There should be transparency about what happens to the data. For non-targets, how long does it stay there?” he asks.

“That information could be in the warrant application.”

In another example where technology utilized by police could impact privacy rights, the provincial privacy commission provided guidance this summer about automated licence plate recognition systems. The OPP was involved in the consultations and agreed to destroy data related to licence plates that do not turn up a “hit” in the system, notes Goodis.

Eric Granger, a defence lawyer at Greenspon Brown & Associates in Ottawa, says police should not be requiring freedom of information requests simply to find out how many times a device or technique was used in any given year.

“My concern as a lawyer and as a member of the general public is that it seems there is an effort to be secretive. What is it the police are hiding and why are they hiding it?” asks Granger.

To date, the only public information about the use of IMSI-catchers by police is from a recent ruling by the federal privacy commissioner in response to a complaint by the non-profit group Open Media.

The ruling disclosed that the RCMP used the device in 125 investigations between 2011 and 2016. Six times no warrant was sought, based on legal advice it had received.

While the RCMP now always seeks warrants, it does so under a new Criminal Code section that requires a judicial officer to have “reason to suspect” a crime has been or will be committed, instead of the general warrant standard of “reason to believe.”

The lack of express rules for police ends up putting more of an onus on the private sector to protect the privacy rights of customers, says Molly Reynolds, a senior associate at Torys LLP in Toronto.

“It is a challenge to comply with both private sector [privacy] legislation and court orders,” says Reynolds, who is on the executive of the privacy law section of the Ontario Bar Association.

One option she suggests is for the federal government and the provinces to come up with a “model code” for new rules about disclosing the use of the technologies by police and what is done with the data of non-targets.

“It could have a standard set of principles and it would be left to the provinces to implement,” she says.

One of the only rulings in Ontario to set out guidelines for tower dump requests was issued by a Superior Court judge last year in a court proceeding initiated by Rogers and Telus. The companies challenged production orders sought by Peel police in a robbery investigation that would initially have required turning over subscriber information for more than 40,000 people.