Spies more free to use cellphone surveillance tech without warrant, under court ruling

A federal court judge has ruled that Canada's domestic spy agency can continue to use contentious cellphone surveillance devices without a warrant, in some cases. 

For several years, the Canadian Security Intelligence Service (CSIS) has used a device it calls a Cell Site Simulator (CSS) to collect information about cellphones and other cellular-capable devices — such as some laptops or tablets — during its national security investigations. 

The devices are perhaps better known as IMSI Catchers or Stingrays, and pretend to be legitimate cellphone towers in order to collect information. Privacy advocates have long criticized the technology for how it indiscriminately gathers data, not merely on the subject of an investigation, but on all of the cellular devices in its operating radius.

According to CSIS, the technology is used for two reasons: to link a cellular device with the subject of an investigation whose identity is often — but not always — already known; and to pinpoint a subject's location. It is not used to capture communications.

But after mounting questions from federal court judges, who only learned the devices were being used by CSIS last year, a recent top-secret warrant application was used to weigh in on the lawfulness of the technique's use. CSIS said previously it sometimes applies for warrants to use such devices and sometimes, for reasons that remain unclear, it has not. 

When does CSIS need a warrant?

In his decision, made public on Tuesday, Chief Justice Paul S. Crampton concluded that:

• CSIS does not need a warrant to use the technology to link a cellular device with the subject of an investigation — in other words, by collecting the unique subscriber number (IMSI) and device number (IMEI).
• CSIS does need a warrant if it wants to use the technology to determine the location of a device.

Use of the cellular surveillance technology was suspended in January while CSIS awaited the outcome of the case, but has since resumed, the agency said.

"For operational security reasons, CSIS is not in a position to further discuss how we use this technology," wrote CSIS spokesperson Tahera Mufti in an email, declining to answer how many times the technique has been used.

CSIS confirmed its use of the technology for the first time in May this year, after the RCMP publicly admitted that it had long used the technology, too.

Under Section 12 of the CSIS Act, the agency is allowed to collect, analyze and retain information without a warrant, as long as it is "strictly necessary" to defend against suspected threats to Canada.

However, Tamir Israel, a staff lawyer at the Canadian Internet Policy and Public Interest Clinic (CIPPIC) believes that, given the type of information CSIS is collecting and how the devices operate, a warrant should be required.

"The impact on non-direct targets can actually be, I think, much more serious than is presented here," said Israel, who co-authored a report on the use of IMSI catchers in Canada. He called the devices "inherently intrusive."

'Minimally intrusive,' court rules

For the case in question, CSIS was investigating the activities of a suspect in connection with what the court described as "Islamist terrorism." 

At issue was whether CSIS' use of an IMSI catcher could be considered an unreasonable search, which is a violation of the Charter of Rights and Freedoms.

Crampton ruled that while the technology technically performs a search — collecting sensitive biographical information that could be used to infer the subject's habits — its use was "narrowly targeted, highly accurate and minimally intrusive." 

He deemed the search reasonable, and therefore lawful, noting that any information collected incidentally — not relevant to the investigation — must be "quickly destroyed and not subject to any analysis whatsoever," within a period of days or weeks.