Spies' use of cellphone surveillance technology suspended in January, pending review

​Canada's spy agency suspended its use of a controversial cellphone surveillance technology in January and placed the investigative technique under review, CBC News has learned.

The Canadian Security Intelligence Service (CSIS) confirmed it has used the cellphone identification and tracking technology in recent years, both with and without a warrant.

The devices are often colloquially referred to as Stingrays after a well-known brand, but are also known as IMSI catchers, mobile device identifiers (MDIs) and cell-site simulators. They collect information about cellphones in a given area by pretending to be legitimate cell towers, and are used by both intelligence agencies and police to investigate crimes or national security threats.

• RCMP reveals use of cellphone surveillance technology
• Someone is spying on cellphones in the nation's capital

"The policy and procedures for use of MDI devices to support CSIS operations is under internal review," agency spokesperson Tahera Mufti wrote in an email. "The use of the devices was suspended until the recommendations of the review are completed."

CSIS declined to comment on what prompted the review, what internal recommendations have been made or why the agency decided to suspend the use of the technology for months.

After a decade of silence, the RCMP revealed last month that it has also been using IMSI catcher technology, prompting other police agencies across the country to make similar disclosures to CBC News.

Unlike the RCMP, CSIS refused to say how frequently it used IMSI catchers, citing "operational security reasons." However, the agency did state that, like the RCMP, "the equipment currently used by CSIS is not capable of intercepting content."

With and without warrants

CSIS told CBC News that in some circumstances it would seek a warrant from a judge to use the technology, much like police.

"CSIS will apply for warrants where it is required to do so because of the manner and the degree in which an investigative technique may intrude upon the privacy of a person," Mufti explained, declining to elaborate on the type of warrant used.

But the CSIS Act also gives Canada's spy agency the authority to use certain investigative powers — in this case, IMSI catchers — without a warrant. University of Toronto law professor Lisa Austin wants to know more about how warrantless uses of the technology are justified.

"Was this because they did not think that the use of the technology intruded upon a reasonable expectation of privacy? That would be a troubling interpretation," Austin said. "Or was it because it was used outside of Canada in circumstances where they did not believe they were subject to the same charter standards in relation to privacy?"

She believes "the question of legal authorization is central here and CSIS needs to answer it."

During a six-month period in 2015, the RCMP also didn't seek warrants for using IMSI catchers to track suspects under the advice of the Department of Justice and an intergovernmental working group on wiretapping technology. The Mounties have since abandoned that practice and now seek a judge's warrant when using the devices.

'We should be very worried'

The review of CSIS's use of surveillance technology comes in the wake of a scathing legal ruling last fall on another controversial data collection practice, involving a little-known group called the Operational Data Analysis Centre (ODAC). 

In that case, a Federal Court judge rebuked CSIS for breaking the law, after it found that the spy agency's analysis centre had collected and stored metadata on Canadians unrelated to its investigations for over ten years.

Metadata could mean the collection of phone numbers or e-mail addresses — data that describes other types of data — but not the actual content of messages. 

It's not clear what sort of metadata the agency retained, and CSIS director Michel Coulombe would only describe the information as "non-threat-related associated data linked with third-party communication."

The Security Intelligence Review Committee (SIRC) that oversees CSIS also called on the spy agency last year to review its policies on bulk data collection and use of warrants to conduct surveillance. 

Lawyer Micheal Vonn, policy director of the BC Civil Liberties Association, says if the spy agency's bulk data collection has taught Canadians anything, it's that "we should be very worried about what CSIS is doing with IMSI catchers."

Vonn says CSIS has shown itself to be interested in "not meeting the threshold of their current statutes, which is that they cannot collect [data] unless it is strictly necessary."

CSIS says the metadata collected by its IMSI catchers was not provided to ODAC.

• Cellphone surveillance tech being used by police across Canada

Part of the problem, according to professor Austin, is Canada's legal system is ill-suited to deal with the collection and protection of metadata — which is often treated as "less private" than, say, the content of a phone call.

Despite the existence of relatively new warranting powers meant to deal more specifically with the use of new technologies such as IMSI catchers — introduced as part of the government's 2015 anti-terror legislation, Bill C-51 — Austin calls those powers "flawed."

"We need to create better models for the legal authorization of these kinds of bulk data techniques," Austin said. "And I think the way to build these better models is to have people in law and policy fields work closely with people in technology fields."