OTTAWA — The RCMP illegally scooped up mobile phone data half a dozen times using controversial Stingray devices, the federal privacy watchdog says.
An investigation by the privacy commissioner's office found that the Mounties now require a judicial warrant for use of the technology, except in emergencies.
The probe also concluded the RCMP was properly hiving off, securing and ultimately destroying the personal information of innocent people collected by the devices.
But the watchdog chastised the national police force for initially refusing to even confirm publicly that it was using the technology, fuelling fears about unnecessary snooping.
The commissioner looked into the RCMP's use of Stingrays in response to a complaint from public-interest group OpenMedia, which had concerns the Mounties were using the devices to monitor large groups of people and the content of their communications.
In a report to OpenMedia, the watchdog said the RCMP's devices were not capable of intercepting voice communications, or email or text messages.
A Stingray device, sometimes called an IMSI catcher, mimics a cellular tower, making all nearby mobile phones connect to it. Identifiers linked to individual phones can then be used to determine their location or owner.
As a result, collection of such data through a Stingray amounts to search and seizure, creating a need for a court-ordered warrant to ensure compliance with the Charter of Rights and Freedoms, the privacy commissioner found.
The RCMP, which has 10 of the devices, says Stingrays are helpful in high-priority investigations relating to national security, serious and organized crime and other criminal offences involving safety and security, such as kidnappings.
The Mounties say they used the devices in 125 criminal investigations from 2011 to 2016. In all but 13 of the cases, judicial warrants were obtained by the RCMP or the local police force the Mounties were assisting.
Seven cases involved emergencies, meaning no warrant was needed. The remaining six cases unfolded in 2015 during a period when the Mounties believed — based on legal advice — that a warrant was no longer required.
Although the Mounties were "operating in good faith," given the legal advice, these six deployments breached the Privacy Act and the charter, and therefore were "not lawfully executed," the privacy commissioner found.
The Mounties revisited the warrant question in 2015, issuing a further directive that October which said recently enacted legislation did indeed mean the collection of data using a Stingray necessitated judicial approval.
The privacy commissioner's report is an important step in holding the RCMP accountable "for the use and capabilities of invasive mass surveillance technologies," said Laura Tribe, OpenMedia's executive director.
"Law enforcement agencies in Canada must be much more forthcoming with information about technologies that put Canadians' privacy at risk."
OpenMedia also expressed concern that police need only have "reasonable grounds to suspect" that an offence has been, or will be, committed in requesting a judicial warrant to use a Stingray.
More needs to be done to strengthen safeguards, including raising the threshold of evidence required for use, Tribe said.
In April, while the privacy commissioner's investigation was underway, the RCMP provided media with a technical briefing, confirming that it does own and use Stingrays.
The privacy commissioner's office expressed appreciation for the Mounties' co-operation with its investigation, but said the police force's initial lack of transparency with the public led to "serious concerns about the capabilities of these devices and how they are being used."
"We strongly encourage the RCMP to continue to make efforts toward openness and accountability in terms of the technologies it employs in its law enforcement activities and the legal authorities it relies on for use of those technologies."
Jim Bronskill, The Canadian Press