The new surveillance state

Ranglin was ultimately convicted of first-degree murder at trial nearly five years later, based on other evidence. None of the information turned over from the tower dump was put to the jury by the Crown. The many individuals who were not a target in the murder investigation yet had personal phone data turned over to the police were not notified of this fact because there is no legal requirement to do so. What happened to this information and with data that is obtained from any other tower dump production order is also unknown, because unlike traditional wiretap authorizations, reporting requirements are virtually non-existent.

Michael Moon, the defence lawyer who represented Ranglin, says tower dump requests are not unusual in Toronto-area murder investigations. “You can have thousands and thousands of people accessing the same tower,” says Moon, who heads Moon Rozier LPC in Brampton, Ont. Unless it uncovers information that may negatively impact a client, there is no reason for the defence to challenge these sweeping orders, he points out.

The Ranglin case is just one example of how police surveillance techniques have fundamentally changed as a result of new technologies. Instead of seeking court permission for traditional wiretaps, law enforcement will obtain orders to access an enormous volume of text messages or other mobile device data. Instead of listening to the wiretaps — or “wires” — police will utilize tower dumps or other devices, such as International Mobile Subscriber Identity — or IMSI — catchers, which impersonate actual cell towers and trick phones into attaching to them and disclosing phone log and location information.

The technological landscape is very different than it was more than three decades ago when Parliament enacted Part VI of the Criminal Code, the “Invasion of Privacy” section. It set up a rigorous framework to oversee police requests to intercept communications, which required judicial approval.

Traditional wiretaps have steadily decreased in recent years and have been replaced by tower dumps, IMSI-catchers and other requests to obtain electronic communications. Unlike Part VI, there is no legislated oversight of these police requests and often law enforcement declines even to admit they use some of the techniques.

Civil liberties and privacy groups have been sounding the alarm in recent years. But it is time for Parliament to fulfil its responsibility to the broader public interest in this area in the same way it did when Part VI of the Criminal Code was enacted, says Nader Hasan, a partner at Stockwoods LLP in Toronto, who specializes in criminal and constitutional law.

“We have recognized for some time now that new technologies have the potential to eviscerate privacy rights. Government has abdicated its important role to police the police. Almost every new protection has been a result of the courts making rules. That is not an effective way to develop broad-based policy,” says Hasan. Relying on individuals who have had privacy rights infringed, especially those who were not targets of a criminal investigation, is unrealistic, he adds.

Barry Friedman, a professor of constitutional law and criminal procedure at the New York University School of Law, suggests the approach of governments in North America to new law enforcement tools is unlike any other area of public policy. “I have terrific respect for police. But they are human, they are not all-knowing,” says Friedman, whose recent book, Unwarranted — Policing Without Permission, examines oversight of law enforcement in the United States.

“We don’t focus on the front end,” states Friedman. “There should be rules that are written down and transparent. We have one new technological device after another and the public has no voice in how they are used [by law enforcement]. That makes no sense. The protector of most of this should not have to be the courts.”

A reliance on courts to rein in state actors if they have gone too far is also common in Canada, but it’s perhaps unfair to our judiciary, says David Loukidelis, associate counsel at Young Anderson barristers and solicitors in Vancouver, B.C. “The courts are always having to play catchup.”

Loukidelis, a former head of the Information and Privacy Commissioner in B.C. and a former deputy attorney general of the province, says it is an added burden to expect judges to develop an expertise in rapidly changing technologies and the impact on privacy when used by law enforcement. “Maybe there is a role for a new specialized watchdog,” he says. Another possibility is for government to appoint an individual to conduct an external and independent review of new technologies and come up with guidelines. “It could be binding or it could be advisory,” he says.

“I think police leadership recognize the need for some limits. We have to be vigilant about the implications of these technologies,” Loukidelis adds.

According to Moon, the existing level of court oversight can be cause for concern. “Police can fax in a request at night and get a fax back with approval minutes later,” he says. As well, Moon notes that he has previously seen production order documents for tower dumps where the time stamps from the fax machine suggested a justice of the peace gave approval before there would have been enough time to read all the materials submitted by police.

The technique is often not reliable in determining where the phone of a suspect was being used, says Moon. “I have had cases where the guy is alleged to be in Toronto and the tower says he is in Kitchener. Tower dumps are better at telling police where people are not,” he adds.

In addition to what critics say is a lack of oversight related to these new techniques, there also appears to be very little public disclosure about their use. Public Safety Canada is required to issue a report to Parliament each year about requests by law enforcement on behalf of the federal government for traditional intercepts, such as wiretaps. These reports indicate that 44 audio intercepts were applied for in 2015 — about half as much as were requested four years earlier.

There is no public data released by any level of government or police service in the country related to the use of tower dumps, IMSI-catchers or any similar techniques that would have obtained private subscriber data from individuals who were not targets of criminal investigation.

The Toronto Police Service, for example, releases a detailed report each year on how many times its officers deployed a Taser. When it received a freedom of information request related to the purchase and use of a Stingray (the best-known brand name of an IMSI-catcher), an Ontario Information and Privacy Commissioner adjudicator agreed in 2015 that it did not have to disclose this information because it could impact its effectiveness in using the device — if it had one.

In a subsequent freedom of information request, after it was already revealed by the media, the Toronto police agreed it had used an IMSI-catcher but did not own the device. It argued though that responding to the followup request, which asked for current details about its IMSI-catcher use, might generate too many “hits” and cause computer problems — a reasoning rejected by adjudicator John Higgins this summer. “The inability to search electronic records for a term such as ‘stingray’ without crashing the computer being used to do the search is untenable for an institution under the Act in the era of electronic record-keeping,” he wrote in his order for Toronto police to conduct a further search for responsive records.

The RCMP, in its organized crime investigation in Montreal called Operation Clemenza, unsuccessfully argued in Quebec Superior Court that it should not have to disclose to the defence the name of the manufacturer of the IMSI-catcher it used. The Crown ultimately issued 36 stays of proceedings earlier this year, stating only that “many factors” went into the decision.

IMSI-catcher devices such as the Stingray, or a cheaper model known as Kingfish, have become controversial in the U.S., where police forces are also reticent about making public information about their use.

The devices capture what is known as metadata for any phone in an area where the IMSI-catcher is activated. “Law enforcement portrays this information as benign. It is just metadata,” notes Hasan. “But it is who you are receiving and sending messages to and your location. You can find out a lot with metadata,” he adds.

Christopher Parsons, a research associate at the Citizen Lab in the Munk School of Global Affairs at the University of Toronto, is blunt in his description. “It is a mass surveillance device,” says Parsons, who co-authored a detailed paper last year about the capabilities of IMSI-catchers and what is known about their use in Canada.

“It has not been robustly evaluated by the courts,” says Parsons, who believes that governments are also not fully appreciating the scope of these devices. Even their exact cost is shrouded in secrecy, he points out, because the manufacturers sign private agreements with police services for training and ongoing software upgrades.

Law enforcement in the U.S. and Canada both stress that the devices are used only for the most serious of criminal investigations. However, research conducted by University of Maryland journalism students recently uncovered an example where police in Annapolis had used one to try to determine the location of a man suspected of stealing 15 chicken wings and three sandwiches from a fast food delivery driver.

In Clemenza, which did involve serious criminal allegations, the RCMP obtained a general warrant. Amendments to the Criminal Code in 2014 related to warrants for a “transmission data recorder” may make it easier for police to obtain court permission to use an IMSI-catcher, but that remains unclear, says Parsons. After the stay of charges in Clemenza, the RCMP issued a news release to say it used this technology in 19 investigations last year. It outlined policy guidelines in very broad terms and promised that “information that is not relevant” to an investigation will be destroyed after all appeal periods have expired.

David Fraser, a privacy lawyer and partner at McInnes Cooper in Halifax, says the level of secrecy is not unusual when it involves new technologies used by police. “A lot of this happens in the shadows,” he suggests. As well, in the case of the RCMP, it is relying on advice from federal Department of Justice lawyers, most of which the government then maintains is privileged and inaccessible to the public, notes Fraser.

Police across Canada have complained publicly about the Supreme Court’s 2014 decision in Spencer, which requires a warrant or production order to obtain the Internet Protocol address of a suspect from a service provider. According to Fraser, though, there is little evidence that the effectiveness of police is hampered by this requirement. “Publicly, they say the sky is falling, but privately, they say they can work around it,” he observes.

Overall, in terms of privacy protection, Fraser says he is more confident with how it is handled by large corporations than by law enforcement. “Companies are, in fact, the ultimate guardians of people’s personal information. The competitor is just a click away,” says Fraser. He notes that a major challenge to the scope of tower dump requests in Ontario was fought by Rogers Communications and Telus Communications. Detailed guidelines for future tower dump requests by police were set out by Superior Court Justice John Sproat in his 2016 ruling in that case. “We probably should be grateful to Rogers and Telus for taking a public stand,” says Fraser.

In fact, the most detailed public information about how many subscribers have had data accessed as a result of tower dumps is in the latest annual transparency report issued by Rogers. It stated that about 37,000 of its subscribers had information turned over last year through tower dump court orders.

This past summer, the federal government introduced legislation to create a new watchdog agency to oversee the Canadian Security Intelligence Service, the Communications Security Establishment and the security functions of the RCMP. At this time, there is no plan to consider reporting requirements similar to ones in place for wiretaps for new surveillance technologies, says Scott Bardsley, spokesman for Public Safety Minister Ralph Goodale.

Bardsley stresses that the IMSI-catchers used by the RCMP and CSIS are not capable of intercepting content (such as text messages, which some of these devices can do). “We are committed to great transparency,” he states. Part of that goal is establishing an advisory group on national security transparency, which will include civil liberties groups, Bardsley explains.

According to Friedman, it may ultimately be appropriate for security agencies and law enforcement to utilize many of these new technologies. But he suggests there needs to be some sort of public vetting at the start.

 “If the public knows and gets to weigh in, then it is defensible,” he states.

Privacy Principles: Canada and U.S. Case Law

Courts in Canada and the United States are increasingly required to weigh in on balancing the interests in law enforcement using new technologies and the potential infringement of privacy interests. U.S. jurisprudence has often been cited by Canadian courts in this area in recent years. In two of the more high-profile sets of decisions with virtually identical issues, our Supreme Court signalled a willingness to be more deferential to law enforcement than its counterpart in the U.S.

Thermal Imaging

R. v. Tessling (2004): Is a warrant required by police using a thermal imaging device to take a “heat” picture of a residence while flying over it with an airplane? The technique was part of a marijuana grow operation investigation, although it was conceded that it could not differentiate whether the imaging was a result of a sauna in a house or a grow-op. A unanimous judgment, issued by Justice Ian Binnie, concluded that a warrant was not required. The imaging “generates information about the house, but section 8 [of the Charter] protects people, not places,” wrote Binnie.

Kyllo v. U.S. (2001): Justice Antonin Scalia, in a 5-4 decision of the U.S. Supreme Court, concluded that thermal imaging was a search within the fourth amendment. “Where, as here, the Government uses a device that is not in general public use, to explore details of the home that would previously have been unknowable without physical intrusion, the surveillance is a ‘search’ and is presumptively unreasonable without a warrant,” wrote Scalia.

Mobile Devices and Search Warrants

R. v. Fearon (2014): When police conduct a search incident to arrest, is a warrant required to search a smartphone or similar mobile device? The majority judgment in the 4-3 ruling, written by Justice Thomas Cromwell, found that a warrant is not required as long as the search is truly incidental to arrest and police keep detailed notes. “Cell phones are the ‘bread and butter’ of the drug trade,” wrote Cromwell. “Prompt cell phone searches incidental to arrest may serve important law enforcement objectives.”

Riley v. California (2014): Chief Justice John Roberts issued the opinion of the U.S. Supreme Court. “Modern cell phones, as a category, implicate privacy concerns far beyond those implicated by the search of a cigarette pack, a wallet, or a purse,” wrote Roberts. “The fact that technology now allows an individual to carry such information in his hand does not make the information any less worthy of the protection for which the Founders fought. Our answer to the question of what police must do before searching a cell phone seized incident to an arrest is accordingly simple — get a warrant,” he wrote.

Data Collection Devices and Techniques

Metadata – This is what is referred to as data about data. In the case of a smartphone, it can include call location, time and length of calls, recipient of the communications and identity of service providers. For online use, it includes browsing and social media usage.

International Mobile Subscriber Identity- Catchers – They are referred to as “cell-site simulators” or by brand names such as Stingray. They impersonate actual cellphone towers and convince mobile devices to connect to them and send information that would normally be transmitted to their service provider. Digital identifiers of every phone in the area, including those used in private residences, can potentially be captured and without the knowledge of a service provider. Instead of passively receiving data, they actively cause mobile devices to identify themselves.

Kingfish – A portable surveillance transceiver that can track and mine information from mobile devices in a targeted area. Often described as a cheaper version of a Stingray, it has fewer capabilities, but it can be controlled wirelessly from a laptop. It can also be concealed in a backpack or briefcase. Its lower price of about US$30,000 has made it popular with law enforcement and government agencies in that country.

Tower Dump – A production order that police in Canada can obtain from a justice of the peace, requiring service providers to turn over all records of cellular traffic at a particular cell tower over a specified time period. The information can include names and addresses of subscribers, location, numbers they called and duration of any call. It may also require credit card information to be turned over. A single cell tower can serve an area with a two-kilometre radius in a city or 10 to 25 kilometres in a rural area.

Crossing the Border: a charter-free zone?

 In its decision in Fearon, the Supreme Court stated that a search warrant is not necessarily required to search a smartphone incident to arrest. However, while not on a par with a strip search, the court agreed that these searches implicate privacy interests. As well, a search of a phone should not be equated with that of a briefcase or documents in someone’s possession at the time of arrest.

What has not been decided yet by any appellate-level court in the country, though, is the privacy interest in one’s phone, tablet or laptop when retuning to Canada.

A section of the Customs Act, enacted three decades ago, permits a border agent to examine “any goods” brought back into the country. No warrant or evidentiary basis is needed.

The federal government and the provinces have argued in lower courts that in the border-crossing context, mobile devices are a “good” and no different than other items in one’s possession — a position sharply criticized by privacy advocates.

“The border is not a Charter-free zone,” says lawyer David Fraser. Without formal rules beyond those of Canada Border Services Agency policies, he suggests, there is potential for abuse. “What if a border agent sees an attractive woman and decides to go through her phone? That would be lawful,” notes Fraser.

 A Charter challenge to the section was before the Ontario Court of Appeal earlier this year in R. v. Saikaley. Ultimately, the court decided the appeal without addressing the constitutional issue.

The legal positions of the federal and Ontario governments and intervener groups, however, were all outlined in detailed written submissions.

Robert Hubbard, lead counsel for the Ontario Ministry of the Attorney General in Saikaley, wrote that when customs officials search phones they are using a regulatory “tool” in a context where the state interest is at its highest. “The fact that customs might share what it learns with other arms of the state (including law enforcement) upon engaging the tool is a separate issue,” Hubbard argued.

The senior Crown attorney stated that “different rules” apply at the border to protect the security of the country. “The state is obligated to interfere with the personal privacy of those crossing our nation’s boundaries,” he wrote.

Nader Hasan, who acted for the Ontario Criminal Lawyers’ Association, which was an intervener in Saikaley, agrees there is a lesser expectation of privacy at the border. “It does not mean, though, that constitutional rights go down the toilet,” he says. For lawyers who travel out of the country, the government assertion that anyone’s mobile devices can be searched without a warrant could lead to violations of solicitor-client privilege, he adds.