RCMP’s use of spyware not known until media reports, privacy commissioner testifies

Canada’s privacy commissioner says his office learned about the RCMP’s use of spyware through the media, and he wants Parliament to strengthen and modernize privacy laws.

Philippe Dufresne appeared Monday before a House of Commons committee that is investigating the use of technology that can be covertly and remotely installed on devices like computers and cellphones to monitor messages and even turn on cameras and microphones.

He said the country’s laws should be changed to include “privacy by design” and create a section in the Privacy Act that requires organizations and departments to do a privacy impact assessment when new technology is introduced that could affect the public.

“These tools may well be needed, but do they have an impact from a privacy perspective that is greater than the intended purpose?” Dufresne said.

The RCMP’s use of spyware technology has raised alarms with privacy and policing experts. The Canadian Civil Liberties Association has called for more information to be made public, and the director of its privacy, technology and surveillance program will appear before the committee Tuesday during the second day of its hearings.

Dufresne said that his office has asked the RCMP for more details, which are expected in a briefing later this month, and that the force says it began a privacy assessment in 2021.

The privacy commissioner’s office was not notified when the RCMP began its privacy impact assessment and the commissioner said he is not sure whether it’s complete or if he will get a copy of it during the briefing.

Several members of Parliament on the committee say they are concerned the assessment began years after the Mounties started using spyware technology. Conservative MP Damien Kurek called it “disappointing” that the commissioner’s office is only being consulted after the fact.

0:41 Privacy commissioner ‘highly doubts’ Canadians knew about government using their cellphone data

In response to a written question tabled in the House of Commons in June, the RCMP disclosed it had obtained warrants in 10 investigations to use tools that collect text messages and emails and can remotely turn on cameras and microphones.

But according to a more recent letter to the privacy and ethics committee from RCMP Commissioner Brenda Lucki, read during the meeting by Liberal MP Lisa Hepfner, the force has used spyware in 32 investigations since 2017 and targeted 49 devices.

Hepfner asked the commissioner if those numbers suggest the technology has not been overused.

“What’s important is that the tools be looked at in terms of their impact, in terms of their purpose and in terms of the public interest that’s at play,” Dufresne said.

“The important thing is that this exercise take place ? it will strengthen trust because it will reassure Canadians.”

Another Liberal MP, Iqra Khalid, questioned whether public scrutiny could allow criminal organizations to “get ahead” of the technology police are using.

Privacy and technology lawyer David Fraser said in an interview Sunday that this concern has been raised in the past, and he has “some sympathy” for that argument.

“But I think that the police and the prosecution service are not qualified to make that critical societal judgment call, because it’s law enforcement interest against public interest,” he said. “And very often law enforcement imagine that law enforcement equals public interest.”

Dufresne said there are some safeguards in place and the RCMP has to get judicial approval for a warrant to hack a device. He also said privacy assessments can take into account the need for confidentiality in investigations.

“Privacy is not an obstacle to public interest.”

Conservative MP James Bezan asked whether surveillance tools such as facial recognition technology are in use by government agencies including CSIS, the Communications Security Establishment and the CBSA.

Dufresne said he is not aware of any government agency using such technology, but he cannot say for certain that they are not.

Members of the RCMP who have overseen the use of spyware technology are expected to appear before the committee later Monday.