Despite official denials, smartphone surveillance and tracking devices called IMSI catchers are being used by Canadian police services. That’s the conclusion reached in major media investigations and the opinion conveyed in a comprehensive report about such activities in Canada.

IMSI catchers, also known by product names like StingRay, are devices that spoof cellphones or smartphones into thinking they are legit cellular towers. IMSI stands for international mobile subscriber identity, a serial number embedded into every smartphone or cellphone. This digital identifier can be linked to particular device or service subscriber.

But the device cannot truly discriminate among those devices or subscribers: lots of phone signals get caught by an IMSI catcher. It’s not just those of a particular target or suspect. The phone use of innocent passersby are just as likely to be swept up.

And different IMSI products have different capabilities. Beyond simply identifying the phone, some catcher devices can record data transmissions, such as point of sale transactions made by waving your smartphone across a wireless chip reader. Some catchers do more than catch: they can monitor, capture or even suppress voice communications. Often an IMSI catcher is mounted in a certain location for a period of time; portable devices that can be easily carried – while still tracking – are also available.

But while some police force use has now been uncovered and acknowledged, the fact that IMSI catchers are in the marketplace means other actors may use them, too. So far, among those who are not acknowledging their use of the smartphone surveillance devices are people spying in major national capitals, like Ottawa and Washington, D.C.!

(In both cities, IMSI catchers have been detected, but no user – authorized or otherwise – has ever been identified. In Ottawa, the catchers were found a couple of years ago; in Washington, recent use was uncovered last week.)

More locally, a recent Toronto Star investigation and published report says that Toronto’s police services used IMSI catcher devices in at least five separate investigations. As the report indicated, that revelation comes after the force denied such use. The force has since acknowledged its error in not revealing its use of the surveillance devices, the Star’s report notes.

Meanwhile, a story in The Globe and Mail cites some 80 police requests for search warrants and authorizations for other activity, including data transmission recording, in a high profile Toronto murder investigation. That evidence was only made public following requests by major media organizations to unseal court documents related to the investigation.

That’s been the unfortunate history of trying to track the trackers: it seems police have used IMSI catchers for years, perhaps a decade or more, but that’s only been uncovered and reported recently in articles in the Globe, the Star and other media outlets. As has long been the case in the tech industry, non-disclosure agreements between users and vendors limit what product and usage information is available, even if the user is a public service or law enforcement agency.

A major report issued by investigators with Citizen Lab, an information and communications technology facility based at the University of Toronto, confirms and elaborates on that checkered history, and the report is cited in many news accounts.

Referencing the apparent cat-and-mouse game going on regarding the use or not of IMSI catchers, the report authors write that “[t]his ongoing secrecy has the effect of delaying important public debates.

“Given the potential for IMSI catchers to massively track Canadians who have done nothing wrong other than be near the surveillance device, it is imperative to ensure [security] measures are in place,” the report asserts.

It’s a comprehensive document and somewhat lengthy read: 141 pages in all.

But authors Christopher Parsons, from Citizen Lab, and Tamir Israel, from the Canadian Internet Policy & Public Interest Clinic, structure the report in a logical and practical way, including a series of best practice recommendations for what seems the inevitable and continued use of smartphone surveillance technology by various actors and agencies, government or otherwise.

The report is divided into four main sections: the first describes the technology and technical capabilities of IMSI catchers; the second section somewhat disconcertingly relates the many challenges faced by researchers and journalists trying to uncover and describe actual IMSI catcher use by law enforcement officials; the third section looks at current and possible legal restrictions or regulations for the use of digital device surveillance tools; and the final section presents ideas for best practices.

Nevertheless, the authors (the report was commissioned by the Telecom Transparency Project and the Canadian Internet Policy & Public Interest Clinic) makes the case quite clearly and convincing: the intrusive nature of cellphone surveillance and the use of IMSI catchers poses an “insidious threat” to our privacy.

 

-30-