RCMP, CSIS launch investigations into phone spying on Parliament Hill after CBC story

Public Safety Minister Ralph Goodale says the RCMP and CSIS have launched investigations in response to a CBC News/Radio-Canada report, which revealed that someone is using devices that track and spy on cellphones in the area around Parliament Hill.

"Obviously we are very anxious to determine who lies at the source of this activity and that's why both CSIS and the RCMP are investigating," Goodale said.

"We want to make sure that we get to the bottom of this and find out the facts and the RCMP and CSIS are in the best position to do that."

Goodale confirms the spying was not being done by a Canadian agency using International Mobile Subscriber Identity (IMSI) catchers. But he could not say whether those using the IMSI catchers might be domestic organized crime, a foreign intelligence agency or some other source.

• Someone is spying on cellphones in the nation's capital
• Mounties conducted unauthorized surveillance of 2 journalists
• Federal officials approved Winnipeg police spying devices
• Liberal bill on parliamentary oversight of security agencies passes

CBC News and Radio-Canada spent months investigating the use of IMSI catchers in and around Parliament Hill in Ottawa. 

The devices work by mimicking a cellphone tower to interact with nearby phones and read the unique ID associated with a phone.

Some catchers can go further

The problem with certain IMSI catchers is they can go a bit further, according to cybersecurity expert Daniel Tobok.

"[Some] can actually intercept your voice communication, your data communication. So your voice calls can be recorded, your text messages could be read," Tobok said in an interview on CBC News Network's Power & Politics.

"That is one of the problems. Somebody could actually intercept your communication and have access into your personal information on your phone."

Tobok said some devices can even intercept encrypted communication applications.

"When somebody casts a very large net and intercepts everything that comes through, then they could have time to potentially decrypt the WhatsApps of the world and any other type of encrypted communication. All depends on who you are dealing with," he told host Rosemary Barton.

It is unclear what kind of IMSI catcher or catchers are being used in the Ottawa area.

Devices detected around Parliament Hill

Reporters ​used a device that detects IMSI catchers created by the German company GSMK. While it looks like a regular cellphone, the CryptoPhone emits an alert when a fake cellphone antenna intercepts its signal.

Media in the United States, Norway and Australia have done similar tests, but this is the first time it has been conducted by a media outlet in Canada.

During tests in December and January, the CryptoPhone set off alerts at locations around Parliament Hill, including the nearby Byward Market, the Rideau Centre shopping mall and CBC offices in downtown Ottawa.

Because IMSI catchers have a radius of about half a kilometre in an urban setting, the IMSI catchers CBC detected could reach territory including Parliament Hill, the Prime Minister's Office in Langevin Block, National Defence headquarters, as well as the U.S. and Israeli embassies.

CBC News and Radio-Canada then used even more sophisticated equipment called an Overwatch Sensor that confirmed the presence of an IMSI catcher close to Parliament Hill.

Sweeping sensitive areas and perimeters is definitely something the RCMP and CSIS should be doing, said Tobok.

Your identity can be 'harvested'

"As you are getting to what we call sensitive areas in the business, your phones, your potential identity is being harvested just to see if you are on a particular list … Washington is very well known for this. Anywhere around Capitol Hill they usually know your IMI number and who's coming, who's going within a particular radius," said Tobok.

Goodale said that like most police and security services around the world, Canadian law enforcement and intelligence agencies use the technology in the course of their work, but only in compliance with the law. 

"Both CSIS and the RCMP have the legal, and privacy, issues that are involved here under active ongoing assessment and reassessment to ensure that in a field where technology is rapidly changing all the time, that our Canadian agencies like CSIS and the RCMP are always staying squarely within the four corners of the law," Goodale said.