An investigation by CBC’s Ottawa bureau has discovered a network of cellphone hacking devices in the nation’s capital – and it’s not clear whether the equipment is foreign or domestic.
The devices, known as IMSI (International Mobile Subscriber Identity) catchers, have been used by Canadian police, foreign intelligence, and organized crime, though every official agency contacted by CBC regarding the devices its team detected, which were strategically placed around some of the highest offices in the federal government, issued denials or declined to comment.
“We got alerts in the ByWard Market, the Rideau Centre shopping mall, and the CBC offices,” reporter Catherine Cullen says in the story, posted on CBC’s website on April 3. “An IMSI catcher has about a half-kilometre radius in a city, which means the catchers we detected could reach all of Parliament Hill.”
ISMI catchers, such as Stingrays, operate by mimicking cellphone towers; but rather than facilitate communication their owners use the devices to detect and track cellphones using their IMSIs, which are unique to each phone, in some cases accessing the phone’s text messages and even listening into calls.
To conduct the investigation, CBC’s team used a CryptoPhone, an IMSI catcher detection device developed by German firm GSMK that emits an alert when its signal is intercepted by a fake cellphone antenna.
Using a more sophisticated Overwatch Sensor, the team also detected an IMSI catcher close to Parliament Hill.
An anonymous Canadian security expert interviewed by CBC said the catchers could be foreign or domestic, noting that Russia has used IMSI catchers in Canada before to spy on CSIS, and that last June the Quebec Superior Court revealed the RCMP had used IMSI catchers during an organized crime investigation.
“We learned that Russian intelligence was parked near CSIS with equipment on board to do IMSI catching,” the anonymous expert told CBC. “After X number of days or weeks, they’re capable of identifying the IMSI numbers that belong to intelligence officers because the phones were spending eight hours a day in the same spot.”
Les Goldsmith, CEO and co-founder of U.S. CryptoPhone supplier ESD America, whose clients include U.S. Homeland Security, said the configurations suggested by CBC’s results could mean the catchers detected in Ottawa were foreign made.
“We’re seeing more IMSI catchers with different configurations and we can build a signature,” Goldsmith told CBC. “So we’re seeing IMSI catchers that are more likely Chinese, Russian, Israeli and so forth.”
The CBC shared its observations with numerous official agencies, none of which shed any light on the results.
A spokesperson for Russia’s Canadian embassy, for example, called any suggestion that the Kremlin could be behind such activities “bogus and baseless,” while the Chinese embassy said it was “not only unreasonable but even irresponsible” to suggest the country would be involved in the activity.
An Israeli spokesperson said they had no knowledge of the issue, while the U.S. declined to comment.
The Communications Security Establishment (CSE) told CBC that by law, the organization is not permitted to direct its activities at Canadians anywhere or at anyone in Canada, and that CSE respects the law.
The Department of National Defence said it had no knowledge of IMSI catchers being used on the dates CBC submitted.
Finally, the Department of Public Safety, the Ottawa Police Service, the RCMP, and CSIS all said they don’t discuss specific investigative techniques but do “follow the law, respect the Charter of Rights and Freedoms, and adhere to the appropriate judicial processes,” according to CBC.
On April 4, public safety minister Ralph Goodale announced that the RCMP and CSIS had launched investigations into the matter as a result of the CBC’s report.