The RCMP keeps adding new information about its court-approved use of spyware on the wireless phones of criminal suspects, leading some members of Parliament frustrated enough to demand more documents from the force.
On Monday, an RCMP official told the House of Commons ethics and privacy committee the force has been using what it calls on-device investigative tools (ODIT) to intercept and copy communications and data since before 2012.
But earlier in the day the committee received a document from RCMP Commissioner Brenda Lucki saying that since 2017, ODITs were used in 32 investigations involving 49 devices.
And that was a change from the RCMP’s written reply to Parliament in June that ODITs were used in 10 instances between 2017 and 2018.
Although Public Safety Minister Marco Mendicino — who the RCMP reports to — insisted the force has never used Pegasus or other spyware tools sold by the controversial Israeli firm NSO Group, and the RCMP insists spyware — like wireline wiretaps — has never been used without a court order, committee members weren’t satisfied with what they heard.
Nor were they happy to hear new federal Privacy Commissioner Phillippe Dufresne testify that his office is still waiting to hear from the RCMP on its privacy impact analysis of its use of ODIT technology. That won’t happen until the end of this month. Dufresne repeated that his office only heard about the RCMP’s use of spyware in June, with the force’s written statement to Parliament. Mendicino said it was “unfortunate” the Privacy Commissioner’s Office had to find out that way. He’s since told the RCMP to work more closely with the office.
In fact, committee chair and Conservative MP Pat Kelly said Lucki’s letter to the committee was “disappointing,” adding said the lack of detail in the letter was “troubling.”
One result was that Saskatchewan Conservative MP James Bezan introduced a motion — to be debated Tuesday — re-affirming the committee’s demand for the RCMP to table more documentation on the kind of information submitted to judges for a court order to insert spyware into a suspect’s wireless device. These documents would have to be vetted by the parliamentary law clerk for sensitive material and only viewed by the committee behind closed doors.
The hearing into device investigation tools used by the RCMP was sparked by the written response in June by the RCMP to a question asked in Parliament about government programs that gather data from Canadians. MPs were caught off guard when the RCMP’s part of the answer admitted the existence of a Covert Access and Intercept Team that, with a court order, placed spyware on suspects’ mobile devices.
As Monday’s hearing started, Public Safety Minister Marco Mendicino said court authorizations come under Part VI of the Criminal Code for intercepting communications that can’t be gained through traditional wiretaps (see section 186). “This is only used under judicial authorization for the most serious offenses,” he said. Respecting privacy, accountability and fundamental rights are paramount.
Mendicino said there are “rigorous steps” the RCMP has to go through to get a court order from a superior court judge. “it is not an easy thing to obtain,” he said. A specific offense has to be alleged, he said, and there are only a limited number of offenses that a warrant for spyware can be applied to.
Mendicino also said other agencies that come under his department have also used spyware “in or about 2017” — although he referred to the RCMP for more detail.
When the RCMP’s turn to testify came, Bryan Larkin, the force’s deputy commissioner for specialized policing services, emphasized that applications for planting spyware had to be time-limited, and targeted against one person. It is never used for mass surveillance, he said.
One of the earliest use of spyware was to help catch Navy Sub-Lt. Jeffery Deslisle selling military secrets to Russia around 2012. Mark Flynn, RCMP assistant commissioner for federal policing, national security and protective policing, told the committee that media reports after Deslisle’s arrest said that police had screenshots from his phone as evidence. Deslisile, a Halifax-based naval threat intelligence analyst, was sentenced in 2013 to 20 years in prison. He was granted full parole in 2019.
Asked by Alberta Conservative MP Damien Kurek about the “hesitancy” of the RCMP to disclose documents to the parliamentary committee, and the fact that the Privacy Commissioner was only told by the RCMP of its use of ODITs after its June document to Parliament, Flynn suggested there were no secrets. He noted that the use of wireless interception technology had been discussed with the privacy commissioner’s office and the Justice Department for 20 years. News articles have been published “to bring more public visibility into what we are doing.”
“We are pulling back the veil,” he said. “We are trying to do that in a way that’s professional, respectful of the law around the protection of tools and techniques.”
“It seems like only after details have been revealed — and it is not limited to this circumstance — is the RCMP upfront about some of the details about their investigation,” replied Kurek.
Sgt. Dave Cobey of the RCMP’s technical case management program, said the 32 cases where spyware was approved since 2017 involved alleged murders, serious drug trafficking, and breaches of trust (one of which involved a police officer).
Not every RCMP request for the use of ODITs is approved by a screening process. Cobey said an annual report to Parliament says only one in 10 requests are approved and go before a judge for authorization.
