The RCMP has been quietly using private surveillance companies to trawl through social media accounts and “publicly available” information on the internet since at least 2015, a new report by Canada’s privacy watchdog reveals.
And the national police force is rejecting the federal privacy commissioner’s recommendations on making their use of “third-party” surveillance vendors more transparent.
The Office of the Privacy Commissioner of Canada (OPC) found that the RCMP “failed to conduct due diligence” to ensure that the information they were receiving from a specific product, called Babel X, was legally collected under Canada’s privacy laws.
The Mounties previously argued that the Privacy Act does not require them to confirm the information, harvested from social media accounts and the “public internet,” was collected legally by their contractors – just that the police force adhered to privacy rules when they used that information.
“There has been an exponential growth in the availability of personal information about individuals over the last two decades,” Privacy Commissioner Philippe Dufresne’s office’s special report, released Thursday, read.
“The idea that the government could collect and use any personal information that can be purchased or accessed online without a fulsome assessment of the legality of the vendor’s practices cannot be accepted, as it would fail to recognize and give effect to the privacy rights of Canadians.”
The report was about “Project Wideawake,” a RCMP initiative first revealed by the independent news outlet The Tyee in November 2020.
Law enforcement “projects” usually refer to specific investigations or operations. But Project Wideawake instead referred to a “particular procurement vehicle used centrally by the RCMP” that allowed the force to access “a range of private sector surveillance/monitoring services” according to the privacy commissioner report.
The initiative was launched in the wake of a 2014 shooting of three police officers.
“The review found that the RCMP was unable to effectively use information posted on social media by members of the public during the course of the attack due to the volume of posts and recommended the RCMP improve its ability to monitor social media in real time,” the report reads.
Intentions aside, the privacy commissioner found that the RCMP’s use of a particular product – Babel X, from a U.S. “threat intelligence” company called Babel Street – was concerning. It allowed the RCMP to search through social media accounts, including those that would not turn up through searches of the “public” internet, and gave the Mounties access to information from unnamed “third-party” data brokers.
The investigation also found the RCMP used a now-discontinued service that allowed it to bypass Facebook users’ privacy settings to access their friends list, although the force apparently only used that tool for a limited time.
“Throughout the investigation, the RCMP consistently described all the information available via Babel X as ‘publicly available’ and therefore identified no issues with respect to its collection either by the RCMP or by Babel X and the related for-fee data sources,” the report found.
“However … (Canadian privacy law) imposes important constraints on the collection of personal information by commercial entities operating in Canada.”
For instance, if someone posts something online, it’s not necessarily fair game for a commercial operation to collect it without that person’s “valid consent … for the collection, use and disclosure of personal information.”
Global sent a list of questions to the RCMP headquarters in Ottawa Thursday morning but did not received answers as of publication time.
The privacy commissioner made three recommendations around the RCMP’s use of private surveillance platforms, none of which were accepted by the national police force.
The recommendations included the RCMP cease collecting personal information from the Babel X platform from social media sites that require logins and authentication to access – such as information that wouldn’t normally turn up in results from a public search engine – until they ensure the practice respects Canadian privacy law.
“Despite the gaps in (the RCMP’s) assessment of compliance with Canadian privacy legislation that our report identifies, the RCMP asserted that it has done enough to review Babel X and will therefore continue to use it,” the report noted.
“In our view, the fact that the RCMP chose a subcontracting model to pay for access to services from a range of vendors does not abrogate its responsibility with respect to the services that it receives from each vendor.”
Comments