Canada's national police force has admitted for the first time its use of spyware to hack mobile phones and laptops to collect data on suspects. .The tech being used is said to give RCMP the ability to remotely turn on the camera and microphone of a device, but it said such tools are only used in the most serious cases when less intrusive techniques are unsuccessful. .RCMP has not been open about the practice of hacking private phones and other devices, but admits it has been using the technology for years..“This is a kind of capability that they have done everything possible to keep incredibly quiet,” said Christopher Parsons, senior research associate at the University of Toronto’s Citizen Lab, as reported by Politico. .“This is a remarkable finding and, for the first time, publicly reveals that the RCMP is using spyware to infiltrate mobile devices, as well as the broad capabilities of their spyware." .It's confirmed RCMP used this technology in 10 investigations between 2018 and 2020. The force said with an increased use of encrypted communication, it needs to employ the use of these new tools. However, critics say it's granting police access to more information than ever before and public discussions are needed to set limits on the use of these intrusive tools. .The RCMP, in a document released last week in the House of Commons, outlined the techniques its Covert Access and Intercept Team (CAIT) use in response to a question from a Conservative MP about how the government may be gathering data from Canadians. .The tools used by RCMP to intercept communication when traditional methods, such as wiretaps, can't be used are called "On Device Investigative Tools (ODITs)," and are considered a version of spyware. These computer programs are "installed on a targeted computing device that enables the collection of electronic evidence.".“In less than a generation, a high number of Canadians migrated their daily communications from a small number of large telecommunication service providers, all of which provided limited and centrally controlled services to customers, to countless organizations in Canada and elsewhere that provide a myriad of digital services to customers,” the document said..“That decentralization, combined with the widespread use of end-to-end encrypted voice and text-based messaging services, make it exponentially more difficult for the RCMP to conduct court-authorized electronic surveillance.”.For instance, the growing use of encrypted messenger services such as Signal can thwart a police request from a cellphone provider to turn over a suspect's text messages, as the data may not be decipherable. However, with the use of spyware, police could intercept the messages before they are encrypted and sent, or after they have been received and decrypted, RCMP explained..With the use of this spyware, the RCMP have the ability to collect a broad range of data including texts, emails, photos, videos, audio files, calendar entries and financial records..The microphone of a targeted device can be activated remotely to record "private communications and other sounds within range" of the device, said the document. .The camera can also be remotely activated to collect "photographic images of persons, places, and activities viewable by the camera built into the targeted device.".The force said it only employs these spyware techniques during serious criminal and national security investigations, and requires the authorization from a judge for each instance. ."The use of [ODITs] is limited to those offences detailed in Section 183 of the Criminal Code, which are primarily serious offences, such as National Security and Organized Crime," said RCMP Sgt. Caroline Duval in a statement to the Western Standard. ."In all investigations where the use of an ODIT is being considered, it is RCMP policy to consult with Crown prosecutors experienced in considering the implications and impacts of technology on search and seizure law."."No authorization will be issued unless the Court has been satisfied that it is in the best interests of the administration of justice to do so.".Duval said ODITs are "used infrequently" and are only deployed when "other investigative methods are incapable of securing the evidence.".In 2016, when the RCMP launched its CAIT program, reporters from two government-funded media outlets were given an inside look at 10 active investigations that were posing issues due to the use of encryption. At that time, the police said they wanted to start a "public debate" about police powers and privacy as the government was looking to explore ways to enhance police capabilities. .“We haven’t had a public debate over the adoption of these tools, while they’re clearly being used by at least the RCMP and potentially other policing forces in Canada,” said Tamir Israel, staff lawyer at the University of Ottawa’s Samuelson-Glushko Canadian Internet Policy and Public Interest Clinic..“It’s really, really concerning that this type of intrusive tool is already in use, and we haven’t had that debate.”.Israel said he believes Canada needs a legal framework around the use of spyware by the authorities, in particular, what should be used and in what circumstances. .Although the RCMP admits it did not consult with the federal privacy commissioner before launching its CAIT program, it said a privacy impact assessment was started in 2021 regarding the team's activities, and will be consulting the privacy watchdog as part of that assessment. .When asked if the RCMP has the capability of installing ODITs on any phone or device, Duval said the force does not "publically disclose details of sensitive investigation tools and techniques." ."The nature of the tools used in criminal investigations are disclosed to the courts, both at the outset of the investigation when seeking judicial authorization, and upon disclosure in subsequent prosecutions," she said.
