Do You Know You May Be Under Surveillance?

Last month I wrote a post on the increasing appetite of police departments to use mass surveillance techniques that make their job easier but represent yet another threat to the privacy rights of citizens. That post revolved primarily around a device called a Stingray, which indiscriminately surveils any cellphone within its multi-kilometre range, and it appears that authorities' appetite for snooping is growing insatiable.

A report, commissioned by the Telecom Transparency Project and the Canadian Internet Policy & Public Interest Clinic and released to The Globe and Mail, explores the use of what are known as ISMI catchers.

An “IMSI,” which stands for “international mobile subscriber identity,” is a unique serial number now affixed to every smartphone’s chip set. It is one of several digital identifiers that police build modern investigations around if they can tie a specific number to a specific suspect.

A major problem is that our government does not seem eager to make such technology part of a consultation with Canadians on security issues. Last week, Public Safety Minister Ralph Goodale announced

he is soliciting the public’s views on the powers of police and spy agencies.

Mr. Goodale’s department posted a backgrounder stating that police are frustrated by criminals’ anonymous use of computers and phones.

Unfortunately that background, which provides context for the consultation, makes no mention of exploring the use of IMSI devices.

[M]ention of the technological equalizers that allow police to bypass corporate gatekeepers have been left out of the government’s consultation exercise. For some pro-privacy advocates, this is the conversation Canadians should be having.

“IMSI catchers pose a particularly insidious threat to real-world anonymity,” write Mr. Parsons and Mr. Israel, who are part of digital-research labs at the Universities of Toronto and Ottawa respectively. Their paper, which is titled “Gone Opaque,” points out that corporations that manufacture IMSI catchers often swear police to non-disclosure agreements.

They suggest the scope of IMSI catchers is currently limited only by the imaginations of government agents who use them. “They can be deployed to geolocate and identify individuals in private homes, to see who visits a medical clinic or a religious meeting, or to identify travelling companions,” the research paper says. “They can be deployed permanently at border crossings, airports or bus depots, or distributed at various points of a city so that movement becomes effectively impossible without a record of it being created.”

Like one of the commentators on this article, many will blithely suggest that if we have nothing to hide, why worry?

Can anyone provide the name of a law-abiding person, or non-terrorist sympathising individual in Canada who has been harmed by the use of IMSI devices?

If we are to be kept safe from both domestic and international terrorists and cyber-criminals, the government needs adequate tools.

Such a stance betrays a naivete that I find intellectually insulting, so narrowly focused as it is on a particular tree that it fails to see the forest.

Unless we are willing to give carte blanche to our government and the security forces that up to now were supposed to operate within confined and constitutional limits, unless we are willing to give absolute trust to those that have so much power over us, I suggest that all of us should be very, very concerned about our rights and freedoms which, as other countries will readily attest, are never truly secure unless citizens are very, very vigilant and engaged.

As one commentator on the article said,

You realize, right, that the aim of "terror" is to attack free societies to make them give up their freedoms. Democracy is not for sissies.

A Time For Some Critical Thinking

With Canada's police chiefs clamoring for new powers that would allow for a massive invasion of our collective privacy, Canadians need to take some time to think critically about our rights and freedoms. As you will see in the following, the first commentator, Rich van Abbe of Toronto, has done just that:

Re: Police chiefs pushing for your passwords, Aug. 17

It’s a bedrock principle of our justice system that no one should be compelled to give evidence against him- or herself.

That makes the demand by Canada’s police chiefs that a law be enacted to force citizens to divulge their computer and phone passwords such an odious suggestion.

There’s no question that authorities engaged in a lawful investigation should be able to obtain warrants from the courts to search suspects’ homes or businesses to seek evidence — even to bust down a locked door if necessary.

But no law requires that a subject of a search tell the cops where evidence may be concealed, or help them retrieve it. Finding it is what detectives are paid to do.

The law the chiefs are demanding might make investigators’ jobs easier, but it would enshrine a perverse violation of the principle of no self-incrimination, one of our most cherished legal protections.

The federal government should slap down this foray against Canadians’ rights in no uncertain terms.

The second letter-writer, Claude Gannon of Markham, is quite happy to surrender his privacy, because he has "nothing to hide":

The police want my password? Here it is. I have nothing to hide.

The Internet has given criminals and radicalized individuals the possibility to operate anonymously, so the police and other law-enforcement bodies must be given the tools to curtail their activities. If this involves getting a hold of someone’s password, then so be it. Honest citizens have nothing to hide and will support the police.

Of course, civil libertarians and constitutional lawyers are very quick to cite privacy concerns, but safety and security should come first. Look around you: do people really care about privacy? Most of us are quite happy sharing our lives with banks, credit card companies, major retailers, rental companies…and the list goes on. Some people even display their whole lives on Facebook.

Let’s face it, we live in an increasingly dangerous world, and we need to give law-enforcement agencies all the help they need to combat crime and terrorism. If this means the occasional breach of privacy, then so be it!

Finally, some fitting irony from Randy Gostlin of Oshawa:

Perhaps we should just assume everyone’s guilty until proven innocent —except, of course, for police. They’re always innocent.

We Should All Be Very Concerned

Given the authorities' recent success in thwarting Aaron Driver's plans for a terrorist attack, I suspect that most Canadians are not too concerned about protecting their privacy rights. The fact that existing laws, legal surveillance and a timely tip from the FBI were responsible for stopping him should, however, be uppermost in our minds as a recent resolution by Canada's police chiefs and technology that allows for indiscriminate eavesdropping are now in the news.

Canada’s police chiefs want a new law that would force people to hand over their electronic passwords with a judge’s consent.

The Canadian Association of Chiefs of Police has passed a resolution calling for the legal measure to unlock digital evidence, saying criminals increasingly use encryption to hide illicit activities.

This law, by the way, would involve unfettered access to all electronic devices that are password-protected, including computers, tablets and cellphones, something that many would argue the state has absolutely no right to.

Thanks to some sleuthing done by my son, who sent me a series of links, you might also be shocked to know that our privacy rights are already being regularly violated by police in what would, in the old days, be called 'fishing expeditions.'

Motherboard reports the following:

The Edmonton Police Service owns a controversial surveillance device called a “Stingray” that indiscriminately surveils any cellphone within its multi-kilometre range, a police spokesperson confirmed on Thursday to Motherboard.

Previously the exclusive domain of the RCMP, these devices

force any phones within a target radius [usually several kilometers] to connect to the device and transmit identifying information. When a phone is caught by a Stingray, the police obtain the phone and SIM card IDs, as well as its location and service carrier. More recent Stingray devices are capable of intercepting voice and text communications. Stingrays surveil phones indiscriminately, leading some commentators to label them as “mass surveillance” devices.

Queries to a several other major police services were met with refusals to acknowledge their use, and now the Edmonton police are trying to backtrack. Police spokeswoman Anna Batchelor has issued a'retraction,' saying that

“there was some miscommunication/misunderstanding internally surrounding the information obtained on whether the EPS owns a StingRay, and in fact, the EPS does not own a StingRay device.”

She said it was police policy not to comment on “equipment used in electronic surveillance or on investigative techniques, therefore EPS cannot provide any further information on this topic.”

This feeble attempt at damage control should fool no one, nor should it lull us into a false sense of our privacy security. The problem is that we are currently dependent only on the honesty and goodwill of police departments to use such devices properly. For example, the Vancouver Police admit to using it only once, and records indicate that use was legitimate and authorized. But there are almost no legal safeguards to its legitimate deployment, as

we have absolutely no policy or regulatory response to police and intelligence agencies’ use of Stingrays despite the RCMP having had Stingrays for over a decade.

Contrast this lackadaisical approach with Germany, which has had federal regulation over such devices since 2002, stipulating the following:

-a warrant is required;

-Stingrays can only be used for investigation of serious crimes;

-Stingrays can only be used to determine suspects’ geo-location (not interception of communication’s content);

-the process must limit the collection of non-suspects’ data;

-non-suspects’ data cannot be used for any purpose other than confirming that it is non-suspects’ data and that this incidentally captured data must be deleted without delay;

-police use of Stingray is subject to reporting requirements for oversight and review.

Canadians, meanwhile, are being kept in the dark:

WE DO NOT KNOW whether warrants are always being sought or the nature of the warrants being applied for;

-WE DO NOT KNOW what judges are being told about the capacities of Stingrays with respect to the warrants being applied for;

-WE DO NOT KNOW if any minimization techniques are used to limit the collection of data of people who are not the targets of surveillance;

-WE DO NOT KNOW what is being done with the personal information of the thousands of people who are not the targets of legitimate police investigation.

Over the years I have tried to chronicle the myriad abuses of authority the police regularly engage in. In these fraught times, the temptation to take shortcuts, violate charter rights and generally abuse the citizenry is high. Now is not the time to give police even greater opportunity for intrusion into and violation of our lives. They need to work within tight and responsible constraints. To do otherwise should be unacceptable to all Canadians.