Cellphone monitoring device use should be transparent and limited, researchers say

A report is slamming Ottawa for its lack of transparency when it comes to government agencies' use of mobile phone monitoring devices.

• CBC INVESTIGATES | RCMP can spy on your cellphone, court records reveal
• Stingray surveillance device questions prompt federal privacy complaint

The devices, known as IMSI catchers, commonly known by their commercial names like Stingray, DRTBOX and Hailstorm, can surreptitiously intercept communications from a mobile device to identify and track the person associated with it.

The report was made by the Citizen Lab at the University of Toronto and the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa.

The authors of the 130-page document lay out three main recommendations: they call for transparency on how the monitoring devices are used, they want to ensure they're only used under strict conditions, and they want to minimize the device's impact on peoples' privacy.

The devices aren't new, but their use is becoming more common. The authors argue this is due to both the fact that 81 per cent of Canadians have a mobile device they carry with them at all times, and because IMSI catchers are getting cheaper.

The authors of the report said the unchecked use of these devices "poses an insidious threat to privacy."

• Download the full report from the Citizen Lab here.

How they work

An IMSI (international mobile subscriber identity) catcher works by mimicking a cellphone tower and gathering information about unique mobile phones in a geographic area, which can be as large a sports stadium. Once the mobile device identifiers are collected, information can be gathered from service providers about the person associated with that specific mobile device.

Service providers are not required to hand over that information to police.

"The police would have to get some judicial authorization, but it isn't entirely clear how onerous it would be for them to get that," said Christopher Parsons, a researcher at the University of Toronto's Citizen Lab who co-authored the report with lawyer Tamir Israel, who works for the Canadian Internet Policy and Public Interest Clinic at the University of Ottawa.

The device, which can fit in a backpack, can also be used in a similar way to a wiretap. It can intercept information that is sent or received by a mobile device. But while a wiretap can only listen in on one phone, a stingray can gather information about thousands of mobile phones.

"Imagine that say, the police in Toronto might be using one of these at a major park. There might be someone who is a bad person [at that park], but by trying to find the one person they will have captured information about every person at that park," said Parsons.

For every legitimate target, Parsons said the device can be intrusive for those who just happen to be in the general area of a target.

One of their recommendations is that "non-target people" should be notified that their information was collected, and police should not retain or use their information.

Unclear who uses them, and for what

Currently, there is no public information about how agencies like the RCMP, CSIS and police forces use these devices.

And it's been incredibly difficult for journalists and privacy advocates to get police services across the country to confirm or deny if they even have such a device, let alone use one.

• Police secrecy on Stingray cellphone surveillance device challenged
• Are StingRay cellphone surveillance systems used by Vancouver police?
• Edmonton police backtrack on StringRay surveillance statement

It's illegal to use uncertified radio devices under the Radiocommunication Act, which this device falls under. Agencies that want to use one must apply for a licence.

But it's unclear which government department issues the licences, and what conditions are placed on the device's use.

Parsons said the secrecy surrounding the licensing and use of these devices creates public distrust of the police and other agencies that may be using them legitimately. He's calling for more transparency.

"An understanding of the rules, policies, legal framework under which these tools are used ought to be on the public record," he said.

A tool of last resort

Parsons said an IMSI catcher's use should be limited to serious crimes like murder. He said that in the U.S., there was an example of a police force using one to catch a person who had stolen chicken wings.

"Maybe in certain circumstances it makes sense to use these devices, but there should be a very high bar set before police are allowed to use them," he said.

He said wiretaps are considered a tool of last resort, and he said the use of IMSI catchers should be no different.

"Otherwise it's like using a sledgehammer when you could just blow something closed," he said.