Science·CBC Investigates

Cellphone surveillance technology being used by local police across Canada

At least six police forces across Canada are now using IMSI catchers, but several of them wouldn’t tell CBC News whether they use the devices to eavesdrop on phone calls and text messages.

CBC News confirms at least 6 police departments use IMSI catchers but several of them won't say for what

Police have described IMSI catchers as a 'vital tool,' used under warrant, to help pinpoint suspects. But civil liberties groups say there's a lack of transparency and oversight in how police deploy the devices. (Reuters)

At least six police forces across Canada are now using cellphone surveillance technology, but several of them won't say whether they use the devices to eavesdrop on phone calls and text messages.

Calgary police, Ontario Provincial Police and Winnipeg police all confirmed to CBC News they own the devices — known as IMSI catchers, cell site simulators or mobile device identifiers (MDIs) — joining the RCMP, which has used the technology for its own investigations and to assist Toronto and Vancouver police.

While Ontario and Winnipeg police refused to say whether they use the technology to intercept private communications, Calgary police and the RCMP insist they only deploy their IMSI catchers to identify — and occasionally, in the RCMP's case, track — cellular devices.

Police have described the surveillance devices as a "vital tool" used under warrant to help pinpoint suspects, and as a first step toward applying for wiretaps in serious criminal and national security investigations.

But Micheal Vonn, policy director of the B.C. Civil Liberties Association and a legal expert on privacy, says she's concerned there isn't a warrant process specific to IMSI catchers that establishes strict limits on how the technology is used given its potential for mass surveillance.

"It's nothing but a policy choice for some law enforcement not to use the content interception capabilities," said Vonn, referring to features some IMSI catchers have to eavesdrop on any cellphone within a radius of several blocks. It's hard to believe "the tantalizing availability of such technology is not going to be exploited," she said. "It will."

In an unprecedented briefing with reporters last week, the RCMP insisted that its IMSI catchers cannot currently intercept calls, text messages and other private communication.

After a decade of silence, the RCMP revealed it owns 10 IMSI catchers, which were used in 19 criminal investigations last year and another 24 in 2015 — including emergency cases such as kidnappings or imminent threats to public safety.

Survey of police forces

CBC News has since contacted 30 provincial and municipal police forces across Canada to ask how many IMSI catchers they own, the number of operators trained to use them, and how many times the technology was used in 2015 and 2016.

Only Calgary police answered in full.

Micheal Vonn, policy director of the B.C. Civil Liberties Association, is concerned police may exploit the surveillance capabilities of IMSI catchers. (BCCLA.org)

Ryan Jepson, the head of Calgary police's technical operations section, said his force has owned one IMSI catcher since 2015. It was used in six investigations that year, and eight more in 2016.

He says the device is only deployed by "a very small group of trained operators" within his unit, and is only used to identify suspects' devices — not track their location or collect the content of their communications.

"It's the same as the RCMP. We don't intercept private communications," Jepson said.

Ontario Provincial Police and Winnipeg police each possess at least one IMSI catcher, but declined to discuss:

  • Whether their technology is used to capture the contents of communications.
  • How many technicians are trained to operate the technology.
  • The number of investigations in which the device was used in 2015 and 2016.

Both forces said revealing more information could jeopardize ongoing investigations, court proceedings, and public and officer safety. But Jepson in Calgary disagrees.

"I have no issues with being transparent about it. It was never the intent to be secretive," he said. "It was about being able to protect certain techniques."

Others deny use

Several police forces told CBC News they neither own nor use IMSI catcher technology, including Charlottetown police; the forces in Thunder Bay, Sudbury, Halton, Hamilton, Kingston, and London, Ont.; and in Quebec City, Laval and Gatineau, and the Quebec Provincial Police.

Police in Montreal, Regina, Halifax, Ottawa, Niagara and Windsor, Ont., declined to comment, citing policies not to discuss investigative techniques.​

And police from York Region, Peel Region, and Waterloo in Ontario, as well as Victoria and the Royal Newfoundland Constabulary either didn't respond in time for publication, or ignored CBC's requests completely. 

Durham Regional Police east of Toronto also ignored repeated requests from CBC to discuss IMSI catcher use, despite applying for a broad federal licence last summer that would allow the force to purchase such a device.

RCMP helps other forces

It's still not clear whether police in Toronto and Vancouver also own and operate their own IMSI catchers, but CBC News has learned that the RCMP has used the technology on behalf of both forces in the past.

Edmonton police said they don't own an IMSI catcher, but declined to say how many times they've used the technology during the past two years — or whether another police force helped them to do so.

An IMSI catcher pretends to be a cellphone tower to attract nearby cell signals. When it does, it can intercept the unique ID number associated with your phone, the International Mobile Subscriber Identity, or IMSI. That number can then be used to track your phone. (CBC)

The technique has been used in multiple Toronto police investigations, but in Vancouver it may have only been deployed once — in an emergency situation involving a missing person in 2007.

"The Device was used in an attempt to locate or verify the presence of a specific and known cellular phone," wrote Darrin Hurwitz, legal counsel for Vancouver police's access and privacy section, in a response last summer to a July 2015 Freedom of Information request from PIVOT Legal Society. "VPD does not own and has never owned this Device."

Vancouver police didn't respond to multiple requests for comment, including about whether the force received additional RCMP assistance or obtained its own device since answering PIVOT's request.

Toronto police spokesperson Mark Pugash wrote in an email that they "do not discuss investigative techniques."

Calls for rules

Watchdog groups have called for specialized warrants and better public reporting of how the devices are being used.

"We want the police to have the appropriate tools," said Vonn of the B.C. Civil Liberties Association. "That they don't have the appropriate oversight and that those tools have the potential for abuse […] the public cares very much about that."

The Office of the Privacy Commissioner of Canada is investigating the RCMP's use of IMSI catchers, following a complaint filed last year.

"What I can tell you is that we are looking at what type of information the IMSI devices and associated software used by the RCMP are capable of capturing," spokesperson Tobi Cohen wrote in an email. "For instance, can and do they only capture the unique identifiers associated with a mobile device or are they also capable of capturing private voice, text and email communications."

Her office called the lack of transparency "a concern," and supports regular public reporting on the use and effectiveness of new technological powers — something the RCMP has said it could support.

ABOUT THE AUTHOR

Matthew Braga

Senior Technology Reporter

Matthew Braga is the senior technology reporter for CBC News, where he covers stories about how data is collected, used, and shared. You can contact him via email at [email protected]. For particularly sensitive messages or documents, consider using Secure Drop, an anonymous, confidential system for sharing encrypted information with CBC News.