After denying use of the controversial technology, documents obtained by the Star show that the Toronto Police Service has used the cellphone data-capturing device known as an IMSI catcher, or Stingray, in five separate investigations.
IMSI catchers capture identifying data from all mobile devices being used in a given location — including, in the context of a police investigation, the data of innocent citizens in the vicinity of the target.
In December 2015, a Toronto police spokesperson told the Star: “We do not use the Stingray technology and do not have one of the units.”
The documents, which took more than two years to obtain through an access-to-information request and subsequent appeal with the province’s information commissioner, say otherwise. They show that Toronto police used the technology in investigations ranging from a major drug and gun case to a bank robbery to a missing person case, starting in 2010.
Asked why the spokesperson, Const. Craig Brister, said Toronto police did not use the device and then why police failed to correct the record, Mark Pugash, head of communications for the service, said: “We should have.”
Brenda McPhail, a privacy, technology and surveillance expert with the Canadian Civil Liberties Association (CCLA), said there has been a long-standing lack of transparency surrounding police use of the devices.
.
“It’s troubling that it took a freedom of information request to confirm, despite past denials, that the (Toronto police) have been using IMSI catchers,” McPhail said.
An IMSI (international mobile subscriber identity) catcher, also known as a mobile device identifier, is a controversial tool because it is indiscriminate in whose mobile device is affected. The technology essentially mimics a cellphone tower, tricking all phones within a particular range to go through it. It can be used to pinpoint the location of a specific phone with far more accuracy than data that can be obtained from a mobile provider like Bell or Rogers.
The device also has the ability to capture other data such as numbers dialed from a phone or text messages, and some can eavesdrop on calls and jam phones to prevent them from being used. Police services that have admitted to using the technology, including the RCMP, have claimed their equipment does not capture private communications, and documents obtained by the Star suggest the same is true for Toronto police.
Although police say it’s a vital investigative tool that has been used in cases involving national security, serious organized crime and more, privacy experts have long decried the secrecy surrounding the device and its use.
“This is a form of mass surveillance,” said Chris Parsons, of the University of Toronto’s Citizenlab.
“It’s a far more intrusive and invasive technology as compared to other tools that are available to law enforcement.”
Asked what Toronto police does with any data from citizens captured through the use of an IMSI catcher, Pugash said the service “does not get third-party data.”
Toronto police used the IMSI catcher during its gang and gun investigations called Project Rx and Project Battery. The probes ran in 2013. (Chris So)
When the Star questioned Pugash further, given that the devices temporarily attract data from cellphones other than those used by the intended target, he said he was unable to answer because the service does not own such a device.
Pugash would not say whether the force had partnered with another police agency that owns the device, such as the RCMP. The Mounties admitted, in a rare press briefing on the devices last year, to owning 10 IMSI catchers.
Documents obtained by the Star suggest that Toronto police requested the RCMP’s IMSI catcher on at least two occasions. (An RCMP spokesperson would not confirm to the Star that their device has been used by Toronto police, citing a policy not to disclose techniques used in specific investigations).
The documents released to the Star through access to information legislation state that Toronto police have used the device on five occasions. Specifics were not provided for two of those uses because “one of the incidents is currently before the courts and the other is still under investigation.”
The service also released a “general warrant” form that they say was used in at least one of the cases, a three-page document that sheds some light on the steps police say they take when using IMSI catchers.
It’s unclear if Toronto police had a warrant in all five cases. Pugash said the service would not use a IMSI catcher without judicial authority or urgent circumstances to prevent the loss of life.
Details for the remaining three incidents are sparse. The documents have been largely blacked out.
Toronto police used Stingray cellphone snooping technology in Projects Rx and Battery, which ran in 2013 and centred on two rival street gangs, the Asian Assassins and Sick Thugz. Here, undercover drug squad officers leave a Liberty Village condominium after a raid linked the projects. (Chris So)
Available details, however, show the device was first used on May 2010. Officers put a trace on a phone of a missing man through Bell Mobility, locating it in Pickering. Durham police then checked the area “with negative results,” according to the documents. The man was later found.
In April 2013, following a bank robbery that involved two suspects armed with a rifle and a handgun, police tracked a cellphone stolen during the heist by using “tracking software installed on the phone.” After tracing the phone to an area near Eglinton Ave. and Weston Rd., one officer noted that the RCMP attended the area and “attempted to locate the phone” but were unsuccessful.
For the third occasion, Toronto police used the device in gang and gun investigations dubbed Projects Rx and Battery, probes that ran in 2013 and centred on two rival street gangs, the Asian Assassins and Sick Thugz. The documents note that Toronto police were granted a warrant authorizing the use of an IMSI catcher.
The general warrant, used by police to get permission from a judge to use the device, answers some questions about how police are proposing to employ the device, including their suggested solution to the issue of third-party data.
According to the document, police say that if the warrant were granted, a trained member of the RCMP would operate the device. That person would ensure investigators were given access to information only about the persons of interest, the warrant states.
What the warrant does not detail, however, is what would happen to the information about “every other innocent individual in the area every time it is activated,” McPhail said.
“The public deserves reassurance that that information is not retained,” she said.
Last year, a senior RCMP officer said all the data captured by their IMSI catchers is considered evidence and will be kept — though nothing except the target information would be accessed. The Ontario Provincial Police, which owns at least one IMSI catcher, has a similar protocol.
“The OPP seals and then destroys any collected data from non-targets (third parties) following court proceedings, including appeal periods and regulatory requirements for retention,” OPP Staff Sgt. Carolle Dionne wrote in an email.
Dionne would not confirm to the Star whether the OPP has ever worked with Toronto police on an investigation involving its IMSI catcher, but said the agency does “assist our municipal policing services when requested.”
The warrant also states that the device would be used as close as possible to the target to “limit the range of the surveillance device as much as is reasonably possible.
“This will reduce the number of mobile telephones which will be affected by the use of the (device),” the warrant states.
The device would also “not receive voice or audio communications and will not receive text messages or emails.”
IMSI catchers capture identifying data from all mobile devices being used in a given location — including, in the context of a police investigation, the data of innocent citizens in the vicinity of the target.
In December 2015, a Toronto police spokesperson told the Star: “We do not use the Stingray technology and do not have one of the units.”
The documents, which took more than two years to obtain through an access-to-information request and subsequent appeal with the province’s information commissioner, say otherwise. They show that Toronto police used the technology in investigations ranging from a major drug and gun case to a bank robbery to a missing person case, starting in 2010.
Asked why the spokesperson, Const. Craig Brister, said Toronto police did not use the device and then why police failed to correct the record, Mark Pugash, head of communications for the service, said: “We should have.”
Brenda McPhail, a privacy, technology and surveillance expert with the Canadian Civil Liberties Association (CCLA), said there has been a long-standing lack of transparency surrounding police use of the devices.
.
“It’s troubling that it took a freedom of information request to confirm, despite past denials, that the (Toronto police) have been using IMSI catchers,” McPhail said.
An IMSI (international mobile subscriber identity) catcher, also known as a mobile device identifier, is a controversial tool because it is indiscriminate in whose mobile device is affected. The technology essentially mimics a cellphone tower, tricking all phones within a particular range to go through it. It can be used to pinpoint the location of a specific phone with far more accuracy than data that can be obtained from a mobile provider like Bell or Rogers.
The device also has the ability to capture other data such as numbers dialed from a phone or text messages, and some can eavesdrop on calls and jam phones to prevent them from being used. Police services that have admitted to using the technology, including the RCMP, have claimed their equipment does not capture private communications, and documents obtained by the Star suggest the same is true for Toronto police.
Although police say it’s a vital investigative tool that has been used in cases involving national security, serious organized crime and more, privacy experts have long decried the secrecy surrounding the device and its use.
“This is a form of mass surveillance,” said Chris Parsons, of the University of Toronto’s Citizenlab.
“It’s a far more intrusive and invasive technology as compared to other tools that are available to law enforcement.”
Asked what Toronto police does with any data from citizens captured through the use of an IMSI catcher, Pugash said the service “does not get third-party data.”
Toronto police used the IMSI catcher during its gang and gun investigations called Project Rx and Project Battery. The probes ran in 2013. (Chris So)
When the Star questioned Pugash further, given that the devices temporarily attract data from cellphones other than those used by the intended target, he said he was unable to answer because the service does not own such a device.
Pugash would not say whether the force had partnered with another police agency that owns the device, such as the RCMP. The Mounties admitted, in a rare press briefing on the devices last year, to owning 10 IMSI catchers.
Documents obtained by the Star suggest that Toronto police requested the RCMP’s IMSI catcher on at least two occasions. (An RCMP spokesperson would not confirm to the Star that their device has been used by Toronto police, citing a policy not to disclose techniques used in specific investigations).
The documents released to the Star through access to information legislation state that Toronto police have used the device on five occasions. Specifics were not provided for two of those uses because “one of the incidents is currently before the courts and the other is still under investigation.”
The service also released a “general warrant” form that they say was used in at least one of the cases, a three-page document that sheds some light on the steps police say they take when using IMSI catchers.
It’s unclear if Toronto police had a warrant in all five cases. Pugash said the service would not use a IMSI catcher without judicial authority or urgent circumstances to prevent the loss of life.
Details for the remaining three incidents are sparse. The documents have been largely blacked out.
Toronto police used Stingray cellphone snooping technology in Projects Rx and Battery, which ran in 2013 and centred on two rival street gangs, the Asian Assassins and Sick Thugz. Here, undercover drug squad officers leave a Liberty Village condominium after a raid linked the projects. (Chris So)
Available details, however, show the device was first used on May 2010. Officers put a trace on a phone of a missing man through Bell Mobility, locating it in Pickering. Durham police then checked the area “with negative results,” according to the documents. The man was later found.
In April 2013, following a bank robbery that involved two suspects armed with a rifle and a handgun, police tracked a cellphone stolen during the heist by using “tracking software installed on the phone.” After tracing the phone to an area near Eglinton Ave. and Weston Rd., one officer noted that the RCMP attended the area and “attempted to locate the phone” but were unsuccessful.
For the third occasion, Toronto police used the device in gang and gun investigations dubbed Projects Rx and Battery, probes that ran in 2013 and centred on two rival street gangs, the Asian Assassins and Sick Thugz. The documents note that Toronto police were granted a warrant authorizing the use of an IMSI catcher.
The general warrant, used by police to get permission from a judge to use the device, answers some questions about how police are proposing to employ the device, including their suggested solution to the issue of third-party data.
According to the document, police say that if the warrant were granted, a trained member of the RCMP would operate the device. That person would ensure investigators were given access to information only about the persons of interest, the warrant states.
What the warrant does not detail, however, is what would happen to the information about “every other innocent individual in the area every time it is activated,” McPhail said.
“The public deserves reassurance that that information is not retained,” she said.
Last year, a senior RCMP officer said all the data captured by their IMSI catchers is considered evidence and will be kept — though nothing except the target information would be accessed. The Ontario Provincial Police, which owns at least one IMSI catcher, has a similar protocol.
“The OPP seals and then destroys any collected data from non-targets (third parties) following court proceedings, including appeal periods and regulatory requirements for retention,” OPP Staff Sgt. Carolle Dionne wrote in an email.
Dionne would not confirm to the Star whether the OPP has ever worked with Toronto police on an investigation involving its IMSI catcher, but said the agency does “assist our municipal policing services when requested.”
The warrant also states that the device would be used as close as possible to the target to “limit the range of the surveillance device as much as is reasonably possible.
“This will reduce the number of mobile telephones which will be affected by the use of the (device),” the warrant states.
The device would also “not receive voice or audio communications and will not receive text messages or emails.”
