After an immensely frustrating back-n’-forth with the Vancouver Police Department (VPD), we are starting to get at least some information about the VPD’s use of surveillance devices known as “Stingrays”.
Stingrays (also known as “IMSI Catchers” or “Cell-Site Simulators”) intercept cell phones’ connections to communications towers in order to scoop up data from cellphones in a given geographical area. These are very controversial devices because they do mass surveillance, not targeted surveillance, and Canadian police have worked really hard to keep their use of these devices secret.
Recently an Inquiry by the BC Information and Privacy Commissioner regarding VPD records about Stingrays was suspended when the VPD amended its response to a freedom of information request that had been made by PIVOT Legal Society. Initially, the VPD said that it “would neither confirm nor deny” that it held any records, but rather than defend that position in the Inquiry, it disclosed that it does not possess a Stingray and has no records responsive to the request. Our views on that part of the story can be found here.
This lead to a further exchange of letters in which we asked much more pointed questions, specifically, whether despite not “having” a Stingray, the VPD might use the RCMP’s Stingrays. And the answer to those questions has now been received: Yes they have used an RCMP’s Stingray and yes, they would do so again.
Okay… so now we’re getting somewhere. Here is a short summary of the Good News and the Bad News based on everything we know to date.
GOOD NEWS
The VPD provided some context for its previous use of a Stingray and on the basis of the information they gave us, we can vouch for their past use (and they say there’s only been one) being legitimate, appropriate and properly authorized.
BAD NEWS
Not only has it taken years to get the most basic and partial of information on this subject, but we are still largely dependent on the good will of the police to use these devices responsibly because protection from illegitimate or abusive use is next to nil.
Contrast this with the case of Germany, which, to my mind, wins the Gold Medal for Stingray transparency and accountability. Germany has had federal regulation since 2002 which specifies that:
a warrant is required;
Stingrays can only be used for investigation of serious crimes;
Stingrays can only be used to determine suspects’ geo-location (not interception of communication’s content);
the process must limit the collection of non-suspects’ data;
non-suspects’ data cannot be used for any purpose other than confirming that it is non-suspects’ data and that this incidentally captured data must be deleted without delay;
police use of Stingray is subject to reporting requirements for oversight and review.
Project Clemenza
Contrast that with Canada where we have absolutely no policy or regulatory response to police and intelligence agencies’ use of Stingrays despite the RCMP having had Stingrays for over a decade. The information from the VPD adds to the very small pile of information we have about the use of Stingrays in Canada, which comes in the main from a recent court case out of Quebec about a 2010 RCMP operation codenamed Project Clemenza.
The over three thousand, heavily redacted pages of the Project Clemenza documents and media reports on those documents tell us most of what we currently know, including that:
One officer testified to personally operating Stingrays in “over 30 different operations” and “on over 50 different subjects”;
Another officer testified that in 2015 the RCMP was maintaining “a large facility” in an undisclosed location for testing Stingrays and developing methodologies;
In Project Clemenza RCMP first sought a “general warrant” for use of the Stingrays, but that conditions for the deployment are laid out by an RCMP Criminal Operations officer and internal authorizations may come before the issuing of the general warrant (that is, it’s unclear what judges are being told);
The RCMP have declined media requests to clarify their authorization process for Stingrays;
The RCMP have also declined requests to clarify what it does with the data it collects on all the people who are not the legitimate targets of police surveillance ( and the Project Clemenza documents suggest that they retain the data).
So, let’s sum this up. Currently, we know that police in Canada are using Stingrays. These are mass surveillance devices which undoubtedly do have legitimate policing uses, but which must be appropriately constrained to avoid abuse (recall, our Charter right to be free from unreasonable search and seizure requires the prevention of unjustified searches before they happen).
Currently, people in Canada have knowledge of almost NO checks to the potential abuse of the extraordinary surveillance powers of Stingrays.
WE DO NOT KNOW whether warrants are always being sought or the nature of the warrants being applied for;
WE DO NOT KNOW what judges are being told about the capacities of Stingrays with respect to the warrants being applied for;
WE DO NOT KNOW if any minimization techniques are used to limit the collection of data of people who are not the targets of surveillance;
WE DO NOT KNOW what is being done with the personal information of the thousands of people who are not the targets of legitimate police investigation.
In short, Canada is way, way behind in crafting a constitutionally-compliant approach to the use of Stingrays, due mainly to the fact that it’s taken over a decade to unearth even enough information to understand how desperately behind we are.
How do we fix this? I suggest we take our cue from Germany. Why, there oughta be a law… In fact, it is arguable that for appropriate constitutional protection, there must be a law.
Stingray surveillance: more of the story
Stingrays (also known as “IMSI Catchers” or “Cell-Site Simulators”) intercept cell phones’ connections to communications towers in order to scoop up data from cellphones in a given geographical area. These are very controversial devices because they do mass surveillance, not targeted surveillance, and Canadian police have worked really hard to keep their use of these devices secret.
Recently an Inquiry by the BC Information and Privacy Commissioner regarding VPD records about Stingrays was suspended when the VPD amended its response to a freedom of information request that had been made by PIVOT Legal Society. Initially, the VPD said that it “would neither confirm nor deny” that it held any records, but rather than defend that position in the Inquiry, it disclosed that it does not possess a Stingray and has no records responsive to the request. Our views on that part of the story can be found here.
This lead to a further exchange of letters in which we asked much more pointed questions, specifically, whether despite not “having” a Stingray, the VPD might use the RCMP’s Stingrays. And the answer to those questions has now been received: Yes they have used an RCMP’s Stingray and yes, they would do so again.
Okay… so now we’re getting somewhere. Here is a short summary of the Good News and the Bad News based on everything we know to date.
GOOD NEWS
The VPD provided some context for its previous use of a Stingray and on the basis of the information they gave us, we can vouch for their past use (and they say there’s only been one) being legitimate, appropriate and properly authorized.
BAD NEWS
Not only has it taken years to get the most basic and partial of information on this subject, but we are still largely dependent on the good will of the police to use these devices responsibly because protection from illegitimate or abusive use is next to nil.
Contrast this with the case of Germany, which, to my mind, wins the Gold Medal for Stingray transparency and accountability. Germany has had federal regulation since 2002 which specifies that:
Project Clemenza
Contrast that with Canada where we have absolutely no policy or regulatory response to police and intelligence agencies’ use of Stingrays despite the RCMP having had Stingrays for over a decade. The information from the VPD adds to the very small pile of information we have about the use of Stingrays in Canada, which comes in the main from a recent court case out of Quebec about a 2010 RCMP operation codenamed Project Clemenza.
The over three thousand, heavily redacted pages of the Project Clemenza documents and media reports on those documents tell us most of what we currently know, including that:
So, let’s sum this up. Currently, we know that police in Canada are using Stingrays. These are mass surveillance devices which undoubtedly do have legitimate policing uses, but which must be appropriately constrained to avoid abuse (recall, our Charter right to be free from unreasonable search and seizure requires the prevention of unjustified searches before they happen).
Currently, people in Canada have knowledge of almost NO checks to the potential abuse of the extraordinary surveillance powers of Stingrays.
In short, Canada is way, way behind in crafting a constitutionally-compliant approach to the use of Stingrays, due mainly to the fact that it’s taken over a decade to unearth even enough information to understand how desperately behind we are.
How do we fix this? I suggest we take our cue from Germany. Why, there oughta be a law… In fact, it is arguable that for appropriate constitutional protection, there must be a law.
CIVIL LIBERTIES CAN’T PROTECT THEMSELVES